CVE-2026-14825: Quiz and Survey Master Auth Bypass Flaw

CVE-2026-14825 Overview

CVE-2026-14825 is a broken access control vulnerability in the Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4. The plugin fails to perform a per-object ownership check before saving a quiz's front-end text settings. Authenticated users with contributor-level access or higher can modify the text settings of quizzes owned by other users. The flaw is categorized as [CWE-639] Authorization Bypass Through User-Controlled Key. The vulnerability requires authentication and yields a limited integrity impact with no confidentiality or availability effect.

Critical Impact
Contributor-level users can tamper with front-end text settings of quizzes belonging to other authors, enabling content manipulation and low-privilege data integrity abuse.

Affected Products

Quiz and Survey Master (QSM) WordPress plugin versions prior to 11.2.4
WordPress sites permitting contributor-level or higher registration
Multi-author WordPress environments running vulnerable QSM installations

Discovery Timeline

2026-08-19 - CVE-2026-14825 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-14825

Vulnerability Analysis

The Quiz and Survey Master plugin exposes an endpoint that saves front-end text settings for a quiz object. The handler accepts a quiz identifier from the request and applies changes without verifying that the requesting user owns the quiz. Any authenticated user assigned the contributor role or higher passes the plugin's capability check and can therefore submit modifications to quizzes created by other users.

This is an Insecure Direct Object Reference (IDOR) pattern. The plugin conflates "has permission to edit quizzes" with "has permission to edit this specific quiz." The result is horizontal privilege escalation across quiz objects. Attackers gain no read access to sensitive data, so confidentiality is not affected. Availability is also unaffected because the endpoint modifies text settings rather than deleting or disabling content.

Root Cause

The root cause is a missing per-object authorization check in the save routine for quiz front-end text settings. The plugin verifies the caller's role but does not compare the quiz's author identifier against the current user identifier before persisting the change. This maps directly to [CWE-639].

Attack Vector

An authenticated contributor sends a crafted request to the QSM settings-save endpoint referencing a quiz ID owned by another author. The server applies the submitted text settings to the target quiz. The attack requires network access to the WordPress site and valid contributor credentials. No user interaction is required. Refer to the WPScan Vulnerability Report for technical detail on the affected endpoint.

Detection Methods for CVE-2026-14825

Indicators of Compromise

Unexpected changes to quiz text fields such as messages, buttons, or result screens on quizzes owned by other authors
WordPress audit log entries showing contributor-role users editing quizzes they did not create
HTTP POST requests to QSM AJAX or admin-ajax endpoints referencing quiz IDs outside the caller's authored content

Detection Strategies

Compare post_author values for QSM quiz objects against the user IDs recorded in recent settings-update audit events
Enable a WordPress audit logging plugin and alert on QSM settings changes performed by non-administrator, non-editor accounts
Review web server access logs for repeated POSTs to QSM save endpoints from a single low-privilege session across multiple quiz IDs

Monitoring Recommendations

Monitor for role escalation attempts and new contributor account registrations on multi-author sites running QSM
Track version strings of installed WordPress plugins and alert when QSM remains below 11.2.4
Baseline normal QSM editorial activity per user and flag deviations in quiz ownership scope

How to Mitigate CVE-2026-14825

Immediate Actions Required

Update the Quiz and Survey Master plugin to version 11.2.4 or later on all WordPress sites
Audit contributor and author accounts and remove any that are unused or unrecognized
Review recent modifications to QSM quizzes and revert unauthorized text setting changes

Patch Information

The vendor addressed the missing ownership check in Quiz and Survey Master version 11.2.4. Administrators should apply this update through the WordPress plugin manager or via WP-CLI. Refer to the WPScan Vulnerability Report for advisory detail.

Workarounds

Restrict contributor-level registrations on sites that do not require multi-author workflows
Temporarily limit QSM quiz editing to administrator or editor roles using a role management plugin until the patch is applied
Place the WordPress admin area behind an authentication proxy or IP allow list to reduce exposure of the vulnerable endpoint

bash

# Update QSM using WP-CLI
wp plugin update quiz-master-next --version=11.2.4
wp plugin list --name=quiz-master-next --fields=name,status,version