CVE-2026-9230

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker versions prior to 11.1.5

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can modify quizzes they do not own, overwrite quiz results pages, and reroute quiz-result notification emails to addresses under their control. The attack involves calling the '/quiz/structure' endpoint with a victim quiz ID to obtain a valid nonce (a unique token used to prevent cross-site request forgery), which is then used at the '/quizzes/{id}/emails' save endpoint to bypass ownership verification.

Recommendations Update to a version newer than 11.1.4. Restrict access to the '/quiz/structure' and '/quizzes/{id}/emails' endpoints to minimize the risk of exploitation.