CVE-2026-14821: QSM WordPress Auth Bypass Vulnerability

CVE-2026-14821 Overview

CVE-2026-14821 affects the Quiz and Survey Master (QSM) WordPress plugin in versions before 11.1.5. The plugin fails to perform a capability check before deleting output templates. Any authenticated user with contributor-level access or higher can delete arbitrary templates on affected sites.

The issue maps to [CWE-862] Missing Authorization. It permits low-privileged contributors to modify plugin state that should be restricted to administrators. Exploitation requires an authenticated session but no user interaction from the target.

Critical Impact
Authenticated contributors can delete arbitrary QSM output templates, disrupting quiz and survey result rendering on affected WordPress sites.

Affected Products

Quiz and Survey Master (QSM) WordPress plugin versions before 11.1.5
WordPress sites with contributor-level or higher user accounts enabled
WordPress installations relying on QSM output templates for quiz result display

Discovery Timeline

2026-07-28 - CVE-2026-14821 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-14821

Vulnerability Analysis

The Quiz and Survey Master plugin exposes an action to delete output templates without validating the caller's WordPress capability. Output templates control how quiz results and survey summaries render to end users. Deleting them removes display logic that site owners have configured.

WordPress uses a role and capability model where contributor accounts are intended to author draft posts and nothing more. QSM's deletion handler treats any authenticated session as sufficient. It does not call current_user_can() with an appropriate capability such as manage_options before performing the destructive action.

The vulnerability is a broken access control issue rather than a code execution flaw. It cannot be used to read data or achieve remote code execution directly. The attack surface is limited to integrity of plugin-managed template records.

Root Cause

The root cause is a missing authorization check [CWE-862] in the QSM template deletion routine. The handler validates that a user is authenticated but does not verify that the user holds the privilege required to manage plugin configuration. Nonce validation, if present, does not compensate because contributors can obtain valid nonces from admin screens they legitimately access.

Attack Vector

An attacker must first obtain contributor-level credentials on the target WordPress site. This is common on multi-author blogs, membership sites, and community platforms that accept contributor registrations. Once authenticated, the attacker issues a request to the QSM template deletion endpoint, supplying the identifier of the template to remove.

The request succeeds because the plugin does not reject callers who lack administrative capabilities. Repeated requests can enumerate and delete every output template on the site. Recovery requires restoring templates from backup or reconfiguring them manually.

Technical details of the vulnerable code path are documented in the WPScan Vulnerability Advisory.

Detection Methods for CVE-2026-14821

Indicators of Compromise

Unexpected deletions of QSM output templates recorded in the WordPress database or plugin logs
POST requests to admin-ajax.php or QSM template endpoints originating from contributor accounts
Quiz or survey pages rendering with missing or default templates after previously working correctly
Contributor-role user sessions performing plugin administration actions

Detection Strategies

Audit WordPress activity logs for template deletion actions performed by non-administrator accounts
Review web server access logs for requests to QSM template management endpoints from low-privileged users
Compare the current QSM template inventory against known-good backups to identify unauthorized removals
Monitor the wp_options or QSM-specific database tables for unexpected record deletions

Monitoring Recommendations

Enable a WordPress security or audit logging plugin that records role-based action attribution
Alert on any contributor-account HTTP request that reaches plugin administration endpoints
Track the QSM plugin version across managed sites and flag installations below 11.1.5
Include WordPress plugin vulnerability feeds such as WPScan in vulnerability management workflows

How to Mitigate CVE-2026-14821

Immediate Actions Required

Update the Quiz and Survey Master plugin to version 11.1.5 or later on every affected WordPress site
Review the contributor user list and remove accounts that are inactive or unnecessary
Restore any QSM output templates that were deleted without authorization from backup
Verify that WordPress core, themes, and other plugins are patched to reduce compounded risk

Patch Information

The vendor addressed CVE-2026-14821 in QSM version 11.1.5 by adding a capability check to the template deletion handler. Site administrators should apply the update through the WordPress plugin dashboard or by replacing plugin files manually. Confirm the installed version reads 11.1.5 or higher after the update.

Workarounds

Restrict contributor account creation until the plugin is updated to 11.1.5 or later
Temporarily deactivate the Quiz and Survey Master plugin if patching cannot be performed immediately
Apply a web application firewall rule that blocks template deletion requests from non-administrator sessions
Downgrade existing contributor accounts to subscriber where authoring privileges are not required

bash

# Update QSM via WP-CLI to remediate CVE-2026-14821
wp plugin update quiz-master-next --version=11.1.5
wp plugin get quiz-master-next --field=version