CVE-2026-14820: Quiz and Survey Master Auth Bypass Flaw

CVE-2026-14820 Overview

CVE-2026-14820 affects the Quiz and Survey Master (QSM) WordPress plugin in versions prior to 11.1.3. The plugin exposes a front-end credential-check endpoint that lacks rate limiting and standard failed-login auditing. The endpoint returns distinct responses for valid and invalid accounts, enabling unauthenticated attackers to enumerate WordPress usernames. Attackers can then brute-force passwords against the discovered accounts while bypassing WordPress brute-force protection controls that monitor wp-login.php. The issue is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated attackers can enumerate valid WordPress usernames and brute-force credentials without triggering brute-force protection mechanisms tied to the standard login endpoint.

Affected Products

Quiz and Survey Master (QSM) WordPress plugin versions prior to 11.1.3
WordPress sites with QSM installed and its front-end credential-check functionality enabled
Any WordPress deployment relying on plugin-level brute-force protection scoped only to wp-login.php

Discovery Timeline

2026-07-27 - CVE-2026-14820 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-14820

Vulnerability Analysis

The Quiz and Survey Master plugin implements a front-end credential-check feature that validates WordPress credentials outside of the core wp-login.php flow. This alternate authentication surface does not implement rate limiting, account lockout, or failed-login auditing. Attackers can submit unlimited authentication attempts without being throttled or logged in a manner consumable by standard security plugins.

The endpoint also produces distinguishable responses depending on whether a submitted username exists. This response differential allows an unauthenticated attacker to enumerate valid accounts prior to attempting password guessing. Because most WordPress brute-force protection plugins hook into wp-login.php or the XML-RPC endpoint, credential attacks delivered through the QSM endpoint bypass those controls entirely.

Root Cause

The root cause is a design flaw in the plugin's credential-check handler. The handler performs authentication logic without invoking WordPress core failed-login hooks such as wp_login_failed, and it returns verbose responses that leak account existence. There is no per-IP or per-account throttling on the endpoint.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted HTTP POST requests to the QSM front-end credential-check endpoint. By observing response differences, the attacker builds a list of valid usernames. The attacker then iterates password candidates against those usernames at high volume, since no rate limiting is enforced. Successful password recovery yields WordPress account access at whatever privilege level the enumerated account holds.

No verified public proof-of-concept code is available. See the WPScan Vulnerability Details advisory for technical specifics.

Detection Methods for CVE-2026-14820

Indicators of Compromise

High-volume POST requests from a single source IP to QSM plugin endpoints under /wp-content/plugins/quiz-survey-master/ or associated AJAX actions
Repeated admin-ajax.php requests referencing QSM credential-check actions without corresponding wp-login.php traffic
Response payload sizes or status codes that cluster into two distinct groups, consistent with valid-versus-invalid username probing

Detection Strategies

Correlate WordPress access logs for sustained request rates to QSM endpoints originating from single IPs or narrow IP ranges
Alert when successful logins occur for accounts that had no prior wp-login.php failure history but show heavy QSM endpoint traffic
Deploy web application firewall (WAF) rules that inspect and rate-limit requests to QSM AJAX actions handling credentials

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or WAF for all plugin AJAX endpoints
Track authentication success and failure events across all entry points, not only wp-login.php
Monitor for anomalous user-agent patterns and request cadence typical of automated credential-stuffing tools

How to Mitigate CVE-2026-14820

Immediate Actions Required

Update the Quiz and Survey Master plugin to version 11.1.3 or later on all WordPress sites
Audit WordPress user accounts for suspicious logins and enforce a password reset for any account showing signs of compromise
Enable multi-factor authentication (MFA) for all WordPress accounts, particularly administrators and editors

Patch Information

The vendor addressed CVE-2026-14820 in Quiz and Survey Master version 11.1.3. The fix introduces rate limiting on the credential-check endpoint, aligns failed-login events with standard WordPress auditing hooks, and normalizes responses to prevent username enumeration. Refer to the WPScan Vulnerability Details advisory for release information.

Workarounds

Disable the Quiz and Survey Master plugin until the site can be updated to version 11.1.3
Restrict access to QSM AJAX endpoints at the WAF or reverse proxy with request-rate limits per source IP
Deploy a WAF rule that blocks requests to QSM credential-check actions from IPs exceeding a defined threshold of failed attempts

bash

# Example nginx rate-limit configuration for WordPress AJAX endpoints
limit_req_zone $binary_remote_addr zone=wpajax:10m rate=10r/m;

location = /wp-admin/admin-ajax.php {
    limit_req zone=wpajax burst=5 nodelay;
    include fastcgi_params;
    fastcgi_pass php-fpm;
}