Authorization

2023-06-0906:15:00

PRIOn knowledge base

www.prio-n.com

authorization

vulnerability

wordpress

9.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.1%

JSON

The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.

CPENameOperatorVersion
quiz_and_survey_masterle8.0.8

CPE	Name	Operator	Version
	quiz_and_survey_master	le	8.0.8

References

packetstormsecurity.com/files/171011/wpqsm808-xsrf.txt

plugins.trac.wordpress.org/changeset/2834471/quiz-master-next

wordpress.org/plugins/quiz-master-next/

www.wordfence.com/threat-intel/vulnerabilities/id/68110321-db1a-4634-98cd-0afd3ec933b8?source=cve