Rahul Sreenivasan

**Name of the Vulnerable Software and Affected Versions** Happyforms – Form Builder for WordPress versions prior to 1.26.13 **Description** The plugin is subject to Local File Inclusion, a condition where an application includes files from the local file system without proper validation. This occurs through the `happyforms get form partial()` function, allowing authenticated attackers with Administrator-level access or higher to include and execute arbitrary .php files on the server. This can lead to the execution of arbitrary PHP code, bypassing access controls, and the theft of sensitive data, particularly if .php files can be uploaded to the server. **Recommendations** Update the plugin to a version newer than 1.26.12. As a temporary mitigation, restrict access to the `happyforms get form partial()` function.

**Name of the Vulnerable Software and Affected Versions** Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress versions through 10.3.1 **Description** The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries, specifically affecting the `is linking` parameter. Authenticated attackers with Subscriber-level access or higher can exploit this to append additional SQL queries, potentially extracting sensitive information from the database. **Recommendations** Update Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress to a version later than 10.3.1.

**Name of the Vulnerable Software and Affected Versions** Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress versions prior to and including 10.3.1 **Description** The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is susceptible to unauthorized access and data modification. This is due to the absence of appropriate capability and status checks within multiple functions. This allows unauthenticated attackers to view details of unpublished, private, or password-protected quizzes. Attackers can also submit file responses to questions within these quizzes, enabling file upload functionality. The vulnerable functions lack proper authorization controls, allowing unauthorized access to sensitive quiz data and potential file uploads. **Recommendations** Update to a version beyond 10.3.1.

**Name of the Vulnerable Software and Affected Versions** Quiz Maker plugin for WordPress versions up to and including 6.7.0.56 **Description** The Quiz Maker plugin for WordPress is susceptible to SQL Injection via manipulated IP headers. This occurs due to inadequate escaping of user-supplied parameters and insufficient preparation of existing SQL queries. Unauthenticated attackers can inject additional SQL queries into existing queries, potentially extracting sensitive information from the database. This is exploitable in configurations where the server retrieves the IP address from a user-supplied field, such as the `X-Forwarded-For` header, and IP-based user restrictions are enabled. The vulnerable parameter is the value provided in the `X-Forwarded-For` header. **Recommendations** Versions prior to 6.7.0.57 should be updated. Disable IP-based user restrictions if the server is configured to retrieve the IP address from a user-supplied field like `X-Forwarded-For`.