CVE-2025-12426

Name of the Vulnerable Software and Affected Versions Quiz Maker plugin for WordPress versions up to and including 6.7.0.80

Description The Quiz Maker plugin for WordPress is affected by a sensitive information exposure issue. The plugin exposes quiz answers through the ays quiz check answer API endpoint without proper authorization checks. The endpoint validates a nonce, but this nonce is publicly available to all site visitors through the quiz maker ajax public localized script data. This allows unauthenticated attackers to extract sensitive data, including quiz answers for any quiz question.

Recommendations Update the Quiz Maker plugin to a version beyond 6.7.0.80.