CVE-2026-9233: WordPress QSM Plugin Auth Bypass Flaw

CVE-2026-9233 Overview

CVE-2026-9233 is an authorization bypass vulnerability in the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress. The flaw affects all versions up to and including 11.1.4. The plugin fails to properly verify user authorization before performing sensitive actions on quiz output templates. Authenticated attackers with contributor-level access or higher can create, modify, and delete quiz output templates stored in the mlw_quiz_output_templates database table. Because the plugin does not sanitize template content, attackers can inject arbitrary HTML, including <script> tags, leading to stored cross-site scripting conditions in rendered quiz output. This weakness is classified under [CWE-862] Missing Authorization.

Critical Impact
Authenticated contributors can inject unsanitized HTML and JavaScript into quiz output templates, enabling stored script execution against other users of the WordPress site.

Affected Products

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress
All versions up to and including 11.1.4
WordPress sites allowing contributor-level or higher accounts

Discovery Timeline

2026-06-27 - CVE-2026-9233 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-9233

Vulnerability Analysis

The vulnerability resides in the QSM plugin's handling of quiz output template operations. The plugin exposes create, modify, and delete actions against the mlw_quiz_output_templates database table without adequate capability checks. Any authenticated user with contributor-level privileges or above can invoke these actions. The referenced source lines in mlw_quizmaster2.php and php/admin/functions.php handle template operations that should be restricted to administrators.

Compounding the missing authorization, the plugin does not sanitize the template body before persisting it. Attackers can store arbitrary HTML, including inline <script> tags, in template records. When those templates are rendered on quiz result pages or email options screens, the injected payload executes in the browser context of any user who views the affected output. This produces a stored cross-site scripting condition tied directly to the authorization gap.

Root Cause

The root cause is missing authorization enforcement on template management endpoints combined with the absence of output sanitization on template content. Capability checks such as current_user_can('manage_options') are not applied to the code paths that modify mlw_quiz_output_templates, allowing lower-privileged roles to reach administrative functionality.

Attack Vector

Exploitation requires an authenticated session with at least contributor-level access. The attacker submits a crafted request to the vulnerable template management endpoint, storing malicious HTML in a quiz output template. When an administrator or visitor triggers rendering of that template, the payload executes with the privileges of the viewing user, enabling session theft, administrative action forgery, or further site takeover.

No verified proof-of-concept code is publicly available. Refer to the
Wordfence advisory and WordPress plugin source references for the
affected code paths in mlw_quizmaster2.php and php/admin/functions.php.

Detection Methods for CVE-2026-9233

Indicators of Compromise

Unexpected records or modifications in the mlw_quiz_output_templates database table containing <script>, onerror=, or onload= substrings
Contributor or author accounts issuing POST requests to QSM plugin admin-ajax or admin-post endpoints handling template actions
Newly created template entries authored by non-administrator accounts
Outbound requests from browsers viewing quiz results to unfamiliar third-party domains

Detection Strategies

Query the mlw_quiz_output_templates table for entries containing HTML tags or JavaScript event handlers and correlate with the authoring user role
Review WordPress access logs for admin-ajax.php or admin.php?page= requests referencing QSM template parameters from non-administrator sessions
Compare current plugin version against 11.1.4 across managed WordPress deployments

Monitoring Recommendations

Enable audit logging for WordPress role changes and plugin option modifications
Alert on template table writes originating from users below the administrator role
Monitor rendered quiz result pages for unexpected script inclusion using content security policy violation reports

How to Mitigate CVE-2026-9233

Immediate Actions Required

Update the Quiz and Survey Master plugin to a version later than 11.1.4 once released by the vendor
Audit all contributor, author, and editor accounts and remove or suspend accounts that are not required
Inspect the mlw_quiz_output_templates table for injected HTML or JavaScript and remove malicious records
Rotate credentials and invalidate active sessions for administrators who may have viewed compromised templates

Patch Information

The vendor changeset referenced in the WordPress plugin repository addresses the missing authorization checks. Site operators should upgrade to the patched release identified in the WordPress Plugin Change Log and validate the fix against the Wordfence Vulnerability Report.

Workarounds

Restrict user registration and remove contributor-level access from untrusted accounts until patched
Deactivate the Quiz and Survey Master plugin if quiz functionality is not essential
Deploy a web application firewall rule blocking POST requests to QSM template endpoints from non-administrator sessions
Enforce a strict Content Security Policy that disallows inline scripts on pages rendering quiz output

bash

# Example: identify installed QSM plugin version via WP-CLI
wp plugin get quiz-master-next --field=version

# Example: audit template table entries containing script tags
wp db query "SELECT id, name, template FROM wp_mlw_quiz_output_templates \
  WHERE template LIKE '%<script%' OR template LIKE '%onerror=%';"