CVE-2026-9230: QSM WordPress Plugin Auth Bypass Flaw

CVE-2026-9230 Overview

CVE-2026-9230 affects the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress in all versions up to and including 11.1.4. The plugin fails to verify that authenticated users are authorized to modify specific quizzes before accepting write operations. Attackers with contributor-level access can modify quizzes they do not own, overwrite quiz results pages, and reroute quiz-result notification emails to attacker-controlled addresses. The flaw is classified under CWE-862: Missing Authorization.

Critical Impact
Authenticated contributors can hijack any quiz on the site, tamper with content shown to visitors, and exfiltrate submitted quiz responses by redirecting notification emails.

Affected Products

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress, all versions up to and including 11.1.4
WordPress sites running QSM with contributor-level accounts or higher
Sites relying on QSM notification emails for quiz result delivery

Discovery Timeline

2026-07-03 - CVE-2026-9230 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-9230

Vulnerability Analysis

The vulnerability is a broken access control flaw in QSM's REST API surface. The plugin issues a nonce that binds a specific quiz ID to the requesting user, then trusts that nonce as a proxy for ownership on subsequent write endpoints. The verification logic never re-checks that the authenticated user actually owns the quiz being modified. An attacker with contributor privileges can therefore mint a valid nonce for any target quiz and use it to authorize destructive changes. The impact includes overwriting result pages served to legitimate site visitors and diverting quiz submissions to an attacker-controlled inbox.

Root Cause

The plugin conflates nonce validity with authorization. The /quiz/structure endpoint generates a nonce keyed to a quiz ID plus the caller's user ID, but the downstream /quizzes/{id}/emails save endpoint accepts that nonce without a separate current_user_can check against the quiz's owner. This design decision leaves authorization enforcement entirely dependent on a token that any authenticated user can request for any quiz.

Attack Vector

Exploitation requires authenticated access at contributor level or higher. The attacker first calls the /quiz/structure REST endpoint with a victim quiz ID. QSM returns a nonce valid for that quiz and the attacker's user context. The attacker then submits that nonce to the /quizzes/{id}/emails save endpoint with modified payloads, such as new recipient addresses for result notifications or overwritten result page content. See the Wordfence advisory for CVE-2026-9230 and the QSM REST API source code for the vulnerable request handlers.

Detection Methods for CVE-2026-9230

Indicators of Compromise

Unexpected changes to quiz result pages or notification email recipients on sites running QSM ≤ 11.1.4
REST API access logs showing sequential calls from a single contributor account to /quiz/structure followed by /quizzes/{id}/emails for quiz IDs the account does not own
New or unfamiliar email addresses configured in QSM quiz notification settings

Detection Strategies

Audit WordPress access logs for REST API requests to QSM endpoints originating from low-privilege accounts, especially contributors touching quizzes authored by other users
Compare current QSM quiz configurations against known-good backups to spot unauthorized modifications to result pages and email routing
Monitor WordPress user activity for contributor-level accounts issuing write operations against admin-owned content

Monitoring Recommendations

Enable REST API request logging on WordPress and forward logs to a centralized SIEM for correlation
Alert on any modification to QSM quiz metadata performed by a user who is not the quiz author
Track outbound mail server logs for QSM notification emails sent to unexpected external domains

How to Mitigate CVE-2026-9230

Immediate Actions Required

Update the Quiz and Survey Master plugin to a version above 11.1.4 as soon as the vendor releases a patched build
Review all existing QSM quiz notification email recipients and revert any unauthorized changes
Audit contributor-level and higher WordPress accounts and disable any that are unused or unrecognized

Patch Information

A fix is tracked in the plugin's WordPress.org changeset 3570062. Site administrators should upgrade beyond version 11.1.4 through the WordPress plugin manager. Refer to the Wordfence Threat Intelligence entry for the latest fixed version guidance.

Workarounds

Restrict contributor-level accounts on sites where QSM is installed until the patched version is deployed
Deploy a Web Application Firewall rule to block unauthenticated or contributor-level requests to /wp-json/quiz-survey-master/v1/quizzes/*/emails write endpoints
Temporarily disable the QSM plugin on high-value sites if contributor accounts cannot be trusted and a patch is not yet installed

bash

# Configuration example: disable QSM plugin via WP-CLI until patched
wp plugin deactivate quiz-master-next

# Verify current installed version
wp plugin get quiz-master-next --field=version

# After patch is available, update to fixed release
wp plugin update quiz-master-next