Truong Tran

**Name of the Vulnerable Software and Affected Versions** PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin versions prior to 2.3.1 **Description** The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin for WordPress contains an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input. The issue exists due to missing validation on user-controlled keys within the `rule id`, `quiz id`, and `item id` parameters. Authenticated attackers with custom-level access or higher can exploit this to modify or delete quiz rules belonging to other teachers, leading to unauthorized tampering of another user's quiz structure. **Recommendations** Update the plugin to a version later than 2.3.0. As a temporary mitigation, restrict access to the `rule id`, `quiz id`, and `item id` parameters for users with custom-level access.