CVE-2026-10623: PressPrimer Quiz IDOR Vulnerability – Patch Guidance for WordPress Educators

Technical summary

CVE-2026-10623 is an Insecure Direct Object Reference (IDOR) vulnerability in the PressPrimer Quiz plugin affecting versions up to 2.3.0. The flaw exists in the 'rule_id' parameter handler, which fails to validate that the authenticated user owns or has permission to modify the quiz rule being targeted. An attacker with custom-level access (or higher role) can supply arbitrary rule_id values to modify or delete quiz structures belonging to other instructors. The vulnerability requires prior authentication and does not expose confidential data, but enables direct manipulation of quiz integrity.

Business impact

For educational institutions and training organizations using PressPrimer Quiz, this vulnerability creates risk of instructional sabotage. A malicious or disgruntled instructor could alter or delete quiz rules configured by colleagues, disrupting course assessments, invalidating grades, or creating administrative chaos. The impact is primarily operational and reputational rather than data-exfiltration-based, but can undermine institutional trust and require rollback of quiz configurations from backups.

Affected systems

WordPress installations running the PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin in any version up to and including 2.3.0 are vulnerable. Exposure is limited to authenticated users with custom-level access or above; users with subscriber or contributor roles are not affected. Organizations using this plugin for course delivery, certification testing, or LMS-backed quizzes should audit their user role assignments and inventory all instructor accounts.

Exploitability

The vulnerability is straightforward to exploit for anyone already holding authenticated access at the custom-level tier or higher. No special tools, network access, or user interaction are required beyond login. However, the threat is primarily insider-focused; external attackers cannot exploit this without first compromising a legitimate instructor account. The barrier to exploitation is low once authentication is obtained, making this a notable privilege-misuse risk in multi-instructor environments.

Remediation

Update the PressPrimer Quiz plugin to a patched version released after 2.3.0 that implements proper authorization checks on the 'rule_id' parameter. Verify against the official plugin repository or vendor advisory for the specific patched version. Until patching is possible, restrict custom-level and higher access to only fully trusted instructors, review role assignments, and enable audit logging on quiz modifications if available.

Patch guidance

Check the WordPress plugin repository for PressPrimer Quiz and install any available version newer than 2.3.0. Verify the patch notes confirm that authorization validation has been added to rule_id parameter handling. Test the patched version in a staging environment to ensure quiz functionality is preserved and that existing quiz rules are not affected by the update. Roll out to production after validation.

Detection guidance

Monitor WordPress audit logs (if enabled via a logging plugin) for modifications to quiz rules by users who do not typically manage those quizzes. Review quiz rule change history within the PressPrimer Quiz plugin settings if available. Query database audit tables for unexpected UPDATE or DELETE operations on quiz rule records, correlating timestamps with user login sessions. Implement Web Application Firewall rules to flag POST/PUT/DELETE requests to quiz rule endpoints originating from non-owner user IDs if the plugin exposes such patterns.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability warrants prompt attention in educational and training environments because it directly undermines quiz integrity and could affect student grades and institutional credibility. The threat is not catastrophic (no data breach, no external access required) but is operationally disruptive. Prioritize patching at institutions with large instructor bases or contentious inter-departmental relationships where insider abuse risk is elevated.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects low attack complexity, no user interaction, and limited impact scope. The vulnerability requires prior authentication (PR:L) and does not compromise confidentiality (C:N), but does enable integrity violations (I:L). The score appropriately excludes external attack vectors and accounts for the low privileged attacker pool. Organizations should not treat this as a critical emergency, but should not defer patching indefinitely either.

Frequently asked questions