CVE-2026-9230: Quiz and Survey Master Authorization Bypass—Email Redirect & Quiz Tampering

Technical summary

CVE-2026-9230 is an authorization bypass (CWE-862) affecting the Quiz and Survey Master plugin versions up to 11.1.4. The flaw exists in the /quizzes/{id}/emails endpoint, which accepts nonces obtained from the /quiz/structure endpoint without verifying that the requesting user owns the target quiz. Because nonces are bound only to the quiz ID and the current user's ID—not to the specific resource being modified—an authenticated attacker can retrieve a nonce for any quiz via the structure endpoint, then present that nonce to the emails endpoint to modify settings on quizzes they do not own. This allows modification of quiz content, results pages, and email routing configuration.

Business impact

Unauthorized modification of quizzes disrupts quiz integrity and can compromise data collection processes. More significantly, email redirection allows attackers to intercept sensitive information submitted through quizzes (user responses, contact details, assessments) before it reaches legitimate administrators. On sites using QSM for lead generation, customer surveys, or assessments, this capability enables credential harvesting or diversion of business intelligence. The attack requires only contributor-level access, a permission level often granted to content creators and external contributors, expanding the threat surface in multi-user WordPress environments.

Affected systems

All versions of the Quiz and Survey Master plugin up to and including version 11.1.4 are affected. The vulnerability impacts any WordPress installation with QSM installed and active, particularly those with multiple user accounts holding contributor or higher privileges. No configuration setting mitigates the flaw—all affected versions are vulnerable regardless of how the plugin is deployed or configured.

Exploitability

Exploitability is straightforward for any authenticated user with contributor-level access or above. The attack requires no special tools or code—attackers need only to make two HTTP requests to WordPress API endpoints that are available to authenticated users. Network access is standard (public endpoints), attack complexity is low, and no user interaction is required. The CVSS score of 4.3 (Medium) reflects the requirement for prior authentication, but the ease of exploitation combined with the sensitive nature of quiz data makes this a practical risk in shared WordPress environments.

Remediation

Update the Quiz and Survey Master plugin to the patched version released after 11.1.4—verify the current stable version in the WordPress plugin repository or the plugin vendor's advisory. The patch implements proper ownership verification on the /quizzes/{id}/emails endpoint and likely other administrative endpoints to ensure nonces are validated against the requesting user's actual permissions. After patching, audit any quiz configurations that may have been modified during the vulnerability window, particularly email destination settings.

Patch guidance

Check the WordPress plugin repository and the Quiz and Survey Master vendor's official advisory for the patched version number. Once identified, update through the WordPress admin dashboard (Plugins > Installed Plugins > Quiz and Survey Master > Update) or via command line (wp plugin update quiz-survey-master). Test the update in a staging environment if the site uses QSM for critical workflows. After patching, verify that quiz email settings and results pages reflect the correct, intended configurations.

Detection guidance

Review WordPress audit logs for API calls to /quiz/structure and /quizzes/{id}/emails endpoints from unexpected user accounts or at unusual times. Check the email settings on all quizzes, particularly those not recently modified by their owners, for suspicious recipient addresses. Monitor for changes to quiz result pages or quiz content that users did not author. If QSM logs are available (via logging plugins or server logs), correlate requests from contributor-level accounts accessing structure endpoints followed by emails endpoints on different quiz IDs. Query quiz metadata in the database for recipient email addresses that do not belong to the site's registered administrators or the quiz creator.

Why prioritize this

Although the CVSS score is Medium (4.3), prioritization depends on the site's use of QSM. For sites using quizzes for lead capture, customer feedback, internal assessments, or regulatory compliance, email interception and quiz tampering pose material business risk. The low barrier to exploitation (any contributor can attack) makes this a practical concern in environments with multiple staff accounts or external content partners. Organizations with strict email security or data handling requirements should treat this as higher priority. Sites using QSM casually (single administrator, no sensitive data collection) face lower risk but should still patch promptly given the simplicity of the fix.

Risk score, explained

The CVSS v3.1 score of 4.3 (Medium) accounts for the authentication requirement (PR:L) and network accessibility (AV:N), low attack complexity (AC:L), and limited integrity impact (I:L) with no confidentiality or availability impact. However, this score does not fully capture the reputational and operational risk of quiz data interception or the ease with which multiple users could exploit it. Organizations handling sensitive survey data or relying on email accuracy for critical workflows should consider the impact context alongside the base score.

Frequently asked questions