CVE-2026-79615: Quiz and Survey Master Auth Bypass Flaw

CVE-2026-79615 Overview

CVE-2026-79615 is a broken access control vulnerability in the Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4. The plugin exposes a REST API route that returns question bank entries without verifying the requester's authorization. Authenticated users with a role as low as Contributor can read questions, hints, and correct answer keys belonging to quizzes owned by other users. The flaw is classified as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Contributor-level accounts can extract quiz questions, hints, and answer keys from other users' question banks through an unauthenticated REST API route, undermining the integrity of assessments and surveys.

Affected Products

Quiz and Survey Master (QSM) WordPress plugin versions prior to 11.2.4
WordPress installations with the QSM plugin enabled and Contributor (or higher) role accounts
Sites relying on QSM question banks for graded quizzes or private surveys

Discovery Timeline

2026-08-28 - CVE-2026-79615 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-79615

Vulnerability Analysis

The Quiz and Survey Master plugin registers a REST API route that returns question bank entries. The route omits an authorization check before returning results. Any authenticated user, including users holding only the Contributor role, can invoke the route and receive question data belonging to quizzes created by other users. Returned data includes question text, hints, and the correct answer keys used for scoring.

The issue is an authorization flaw, not an authentication flaw. WordPress correctly authenticates the requester, but the plugin does not verify that the authenticated user owns the requested question bank entry or has capability to read it. The result is a horizontal privilege escalation across low-privileged users.

Root Cause

The REST callback function does not check the current user's capabilities or compare ownership of the requested resource against the requester. The route relies on identifiers supplied by the client and returns matching records without filtering by author or role. This pattern maps directly to CWE-639, where access is granted based on a user-controlled key rather than an authorization decision.

Attack Vector

An attacker requires a valid Contributor account on the target WordPress site. Many WordPress deployments allow open registration or grant Contributor access to guest authors. The attacker sends authenticated HTTP requests to the vulnerable QSM REST route, iterating over question bank identifiers. The response body contains questions, hints, and correct answers for each identifier. No user interaction from the victim is required.

The vulnerability affects confidentiality only. It does not permit modification of quiz data or denial of service through this route. Refer to the WPScan Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-79615

Indicators of Compromise

Authenticated REST API requests to QSM question bank routes originating from Contributor-level accounts
High-volume enumeration of sequential question or quiz identifiers from a single authenticated session
Access log entries showing /wp-json/ requests to QSM endpoints from users who did not author the target quizzes

Detection Strategies

Review WordPress access logs for authenticated requests to QSM REST routes and correlate the requester with quiz ownership metadata in the database
Enable WordPress REST API request logging and alert on Contributor-role accounts accessing plugin endpoints tied to other authors' content
Compare the QSM plugin version reported by wp plugin list against the fixed version 11.2.4

Monitoring Recommendations

Monitor for anomalous REST API request patterns, particularly sequential identifier enumeration against /wp-json/qsm/ routes
Track newly created Contributor accounts followed by immediate REST API activity
Audit which users hold Contributor or higher roles and remove dormant or unnecessary accounts

How to Mitigate CVE-2026-79615

Immediate Actions Required

Upgrade the Quiz and Survey Master plugin to version 11.2.4 or later on all WordPress installations
Audit existing user accounts and remove or downgrade any Contributor-role accounts that are not actively needed
Disable open user registration on sites that do not require it, or restrict default new-user roles to Subscriber

Patch Information

The vendor addressed the flaw in Quiz and Survey Master version 11.2.4. The fix adds an authorization check to the affected REST API route so that only users with appropriate capabilities can retrieve question bank entries. Deployment details are available in the WPScan Vulnerability Report.

Workarounds

Deactivate the QSM plugin until the update to 11.2.4 can be applied if question banks contain sensitive assessment content
Restrict access to the WordPress REST API using a web application firewall rule that blocks unauthenticated and low-privileged access to QSM routes
Remove Contributor accounts from production sites hosting graded quizzes, and use editorial workflows that do not require the Contributor role

bash

# Update Quiz and Survey Master via WP-CLI
wp plugin update quiz-master-next --version=11.2.4
wp plugin list --name=quiz-master-next --fields=name,status,version