CVE-2025-10493 Overview
CVE-2025-10493 affects the Chained Quiz plugin for WordPress in versions 1.3.4 and below. The vulnerability is an Insecure Direct Object Reference (IDOR) [CWE-639] in the quiz submission and completion mechanisms. The plugin fails to validate a user-controlled key, specifically the chained_completion_id cookie value.
Unauthenticated attackers can manipulate this cookie to hijack and modify other users' quiz attempts. This allows tampering with quiz answers, scores, and results belonging to any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.
Critical Impact
Unauthenticated attackers can alter quiz answers, scores, and results of any user by manipulating a client-controlled cookie value.
Affected Products
- Chained Quiz plugin for WordPress versions 1.3.4 and below
- Partially patched in version 1.3.4
- Partially patched in version 1.3.5
Discovery Timeline
- 2025-09-18 - CVE-2025-10493 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10493
Vulnerability Analysis
The Chained Quiz plugin tracks quiz attempts using the chained_completion_id cookie. This identifier maps a browser session to a quiz completion record stored server-side. The plugin trusts this cookie value without verifying that the requester is authorized to access or modify the referenced record.
Because the identifier is predictable and client-controlled, an attacker can substitute another user's completion identifier into their own cookie. Subsequent submission and completion requests then operate on the victim's quiz record. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Root Cause
The root cause is missing authorization validation on the chained_completion_id value. The plugin controllers and models process quiz state updates based solely on the cookie-supplied identifier. No session ownership check ties the completion record to the requesting client. Reviewers can inspect the vulnerable logic in the WordPress Plugin Code Review and the WordPress Plugin Model Review.
Attack Vector
The attack requires no authentication and no user interaction. An attacker enumerates or guesses chained_completion_id values assigned to other quiz takers. The attacker sets the harvested value in their own chained_completion_id cookie and issues quiz submission or completion requests. The server applies the attacker's payload to the victim's attempt, changing answers, scores, or final results. See the Wordfence Vulnerability Analysis for additional context.
The vulnerability manifests in the quiz completion flow where the chained_completion_id cookie is dereferenced against the database without an ownership check. Refer to the linked plugin source and changesets for implementation-level detail.
Detection Methods for CVE-2025-10493
Indicators of Compromise
- Multiple HTTP requests to Chained Quiz submission endpoints from a single client using different chained_completion_id cookie values in rapid succession.
- Quiz completion records showing answer or score modifications from IP addresses that differ from the original submitter.
- Sequential or brute-forced numeric chained_completion_id values appearing in web server access logs.
Detection Strategies
- Inspect web server logs for anomalous cookie manipulation patterns targeting the Chained Quiz plugin endpoints in wp-content/plugins/chained-quiz/.
- Correlate quiz completion database records with the originating client IP address and user agent to identify mismatches.
- Deploy a Web Application Firewall (WAF) rule that flags requests altering the chained_completion_id cookie between successive requests from the same session.
Monitoring Recommendations
- Monitor the WordPress plugin version inventory and alert on installations of Chained Quiz at or below version 1.3.5.
- Track integrity of the wp_chained_quiz_contacts and related quiz tables for out-of-band modifications.
- Enable verbose access logging for /wp-admin/admin-ajax.php actions associated with the plugin.
How to Mitigate CVE-2025-10493
Immediate Actions Required
- Update the Chained Quiz plugin to the latest available version beyond 1.3.5 once a complete fix is released.
- Audit existing quiz records for unauthorized modifications, focusing on entries with mismatched IP addresses or timestamps.
- Deactivate the plugin if quiz integrity is business-critical and no complete patch is yet available.
Patch Information
The vulnerability was partially addressed in Chained Quiz versions 1.3.4 and 1.3.5. Review the vendor commits at WordPress Changeset 3362561, WordPress Changeset 3362701, and WordPress Changeset 3362966. Because the fix is partial, administrators should monitor the plugin repository for a full remediation.
Workarounds
- Restrict access to quiz submission endpoints using WAF rules that validate the origin and session context of chained_completion_id cookies.
- Disable public quiz functionality and require WordPress authentication for quiz access to reduce the anonymous attack surface.
- Rotate and invalidate active chained_completion_id cookies after each quiz completion via server-side session cleanup.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
