CVE-2025-12426: Quiz Maker Information Disclosure Flaw

CVE-2025-12426 Overview

The Quiz Maker plugin for WordPress contains a Sensitive Information Exposure vulnerability affecting all versions up to and including 6.7.0.80. This security flaw allows unauthenticated attackers to extract quiz answers through the ays_quiz_check_answer AJAX action due to improper authorization checks. The endpoint relies solely on nonce validation, but the required nonce is publicly accessible to all site visitors via the quiz_maker_ajax_public localized script data, rendering the protection ineffective.

Critical Impact

Unauthenticated attackers can extract sensitive quiz answers for any quiz question on affected WordPress sites, potentially compromising the integrity of educational assessments, certification exams, and other quiz-based content.

Affected Products

• Quiz Maker plugin for WordPress (all versions up to and including 6.7.0.80)
• ays-pro quiz_maker
• WordPress sites utilizing the Quiz Maker plugin

Discovery Timeline

• 2025-11-19 - CVE-2025-12426 published to NVD
• 2025-12-12 - Last updated in NVD database

Technical Details for CVE-2025-12426

Vulnerability Analysis

This vulnerability represents a classic case of broken access control in WordPress plugin development. The Quiz Maker plugin implements an AJAX endpoint (ays_quiz_check_answer) designed to verify quiz answers, but fails to implement proper authorization checks. While the developers implemented nonce verification as a security measure, they inadvertently exposed the nonce token publicly through the quiz_maker_ajax_public localized script data, which is accessible to all visitors on the front-end of the site.

The fundamental issue lies in the misunderstanding of WordPress nonce functionality. Nonces in WordPress are designed to protect against CSRF attacks by ensuring that actions originate from the site itself, but they are not meant to serve as authorization tokens. Since the nonce is embedded in publicly accessible JavaScript, any visitor can retrieve it and use it to query the AJAX endpoint for quiz answers.

Root Cause

The root cause is an authorization bypass vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The plugin exposes the AJAX nonce in the quiz_maker_ajax_public localized script data, which is loaded on every page where the quiz is rendered. This allows unauthenticated users to harvest the nonce and make authorized requests to the ays_quiz_check_answer endpoint, bypassing any intended access restrictions.

The vulnerable code pattern involves:

1. Registering an AJAX action handler for both authenticated and unauthenticated users
2. Using nonce verification as the sole authorization mechanism
3. Exposing the nonce publicly through wp_localize_script()

Attack Vector

The attack can be executed remotely over the network without any user interaction or authentication. An attacker simply needs to:

1. Visit a WordPress site with the vulnerable Quiz Maker plugin installed
2. Extract the publicly available nonce from the page source or JavaScript variables
3. Send crafted AJAX requests to the ays_quiz_check_answer endpoint with the harvested nonce
4. Enumerate question IDs and retrieve correct answers for any quiz on the site

The vulnerability mechanism involves intercepting the publicly exposed nonce value from the quiz_maker_ajax_public JavaScript object and using it to make authorized AJAX calls to retrieve quiz answers. Technical implementation details can be found in the WordPress Plugin Repository code references and the Wordfence vulnerability report.

Detection Methods for CVE-2025-12426

Indicators of Compromise

• Unusual volume of AJAX requests to the ays_quiz_check_answer endpoint from single IP addresses
• Sequential enumeration patterns in quiz question ID parameters
• Requests to the AJAX endpoint from users who have not loaded a quiz page
• Automated or scripted request patterns targeting the WordPress admin-ajax.php endpoint with quiz-related actions

Detection Strategies

• Monitor web application firewall (WAF) logs for repeated requests to wp-admin/admin-ajax.php with the action parameter ays_quiz_check_answer
• Implement rate limiting on AJAX endpoints to detect and block enumeration attempts
• Review server access logs for patterns indicating automated answer harvesting
• Deploy intrusion detection rules that flag suspicious sequences of quiz-related AJAX requests

Monitoring Recommendations

• Configure alerting for anomalous traffic patterns to the Quiz Maker AJAX endpoints
• Implement logging for all requests to the ays_quiz_check_answer action
• Set up automated analysis to correlate AJAX requests with legitimate quiz-taking sessions
• Monitor for bulk data extraction patterns that may indicate answer harvesting campaigns

How to Mitigate CVE-2025-12426

Immediate Actions Required

• Update the Quiz Maker plugin to a version newer than 6.7.0.80 that addresses this vulnerability
• Audit quiz results for any anomalies that might indicate prior exploitation
• Consider temporarily disabling the Quiz Maker plugin until patching is complete
• Review and rotate any quiz content that may have been compromised

Patch Information

Site administrators should update the Quiz Maker plugin to the latest available version through the WordPress admin dashboard. Navigate to Plugins > Installed Plugins, locate Quiz Maker, and click Update Now if an update is available. Verify the installed version is greater than 6.7.0.80 after updating.

For additional details, refer to the Wordfence Vulnerability Report.

Workarounds

• Implement a custom WordPress filter or plugin to add proper capability checks to the ays_quiz_check_answer AJAX handler
• Use a Web Application Firewall (WAF) to block or rate-limit requests to the vulnerable endpoint
• Restrict access to admin-ajax.php at the server level for specific actions if feasible
• Consider disabling the plugin entirely until an official patch is available

# Example: Add rate limiting for AJAX endpoints in Apache .htaccess
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php
  RewriteCond %{QUERY_STRING} action=ays_quiz_check_answer [NC]
  RewriteRule ^ - [F,L]
</IfModule>