CVE-2026-14826 Overview
CVE-2026-14826 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in the Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4. The plugin exposes REST routes that return a quiz's email-notification and results-page configuration without performing a per-object ownership check. Authenticated users with contributor-level access or higher can query these endpoints to read configuration data belonging to quizzes created by other users. Exposed data includes notification recipient email addresses and results-page settings. The flaw requires authenticated access and does not affect integrity or availability.
Critical Impact
Authenticated contributors can read email-notification and results-page configuration, including recipient email addresses, of quizzes owned by other users.
Affected Products
- Quiz and Survey Master (QSM) WordPress plugin versions prior to 11.2.4
- WordPress sites permitting contributor-level or higher user registration
- Multi-author WordPress deployments using QSM for quizzes or surveys
Discovery Timeline
- 2026-08-19 - CVE-2026-14826 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-14826
Vulnerability Analysis
The vulnerability resides in the QSM plugin's REST API routes that serve per-quiz configuration data. These routes authenticate the requester but fail to authorize the requester against the target object. Any user holding at least the WordPress contributor role can invoke the endpoint with an arbitrary quiz identifier and receive the configuration payload. The disclosed payload includes email-notification templates, notification recipient addresses, and results-page settings authored by other users.
The attack requires no user interaction and produces no direct integrity or availability impact. Confidentiality impact is limited to configuration metadata rather than quiz responses or credentials. However, the leaked recipient email addresses enable targeted phishing and reconnaissance against site operators and quiz owners.
Root Cause
The root cause is a missing per-object ownership check on REST endpoints [CWE-639]. The plugin verifies that the caller holds the required WordPress capability but does not verify that the caller owns or has been granted access to the quiz identified in the request. Authorization decisions rely solely on role membership rather than object-level ACLs.
Attack Vector
An attacker with contributor-level or higher credentials sends REST requests to the vulnerable QSM routes, iterating quiz IDs to enumerate quizzes owned by other authors. The server returns the notification and results-page configuration for each requested quiz. No elevation, chaining, or client interaction is required beyond an authenticated session.
Because no verified proof-of-concept code is published, the vulnerability is described in prose only. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-14826
Indicators of Compromise
- REST API requests to QSM quiz configuration endpoints originating from low-privilege user sessions
- Sequential enumeration of quiz IDs in wp-json request logs from a single authenticated user
- Access to quiz configuration routes by users who are not the quiz author
Detection Strategies
- Review WordPress and web server access logs for wp-json requests targeting QSM routes issued by contributor-level accounts
- Alert on any single authenticated session that requests configuration for multiple quiz IDs across different authors within a short window
- Correlate REST access patterns with the wp_users and wp_posts tables to detect access to objects not owned by the requester
Monitoring Recommendations
- Enable verbose logging on WordPress REST API traffic and forward to a centralized logging platform
- Baseline normal QSM REST usage per role and alert on deviations, particularly by contributor accounts
- Monitor for unexpected outbound phishing activity referencing email addresses that may have been harvested from quiz configurations
How to Mitigate CVE-2026-14826
Immediate Actions Required
- Upgrade the Quiz and Survey Master plugin to version 11.2.4 or later on all WordPress sites
- Audit contributor-level and higher accounts and remove unused or untrusted users
- Review QSM notification recipient lists and rotate any exposed operational email addresses if disclosure is suspected
Patch Information
The vendor addressed the issue in Quiz and Survey Master version 11.2.4 by adding per-object ownership checks to the affected REST routes. Administrators should apply the update through the WordPress plugin manager. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Restrict user registration and avoid granting contributor or higher roles to untrusted users until the patch is applied
- Deploy a web application firewall rule to block REST requests to QSM quiz configuration endpoints from non-administrator sessions
- Temporarily disable the QSM plugin on high-value sites that cannot immediately upgrade
# Update the QSM plugin using WP-CLI
wp plugin update quiz-master-next --version=11.2.4
wp plugin list --name=quiz-master-next --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
