CVE-2026-9233: Authorization Bypass in Quiz and Survey Master WordPress Plugin

Technical summary

CVE-2026-9233 is an authorization bypass vulnerability in the Quiz and Survey Master (QSM) WordPress plugin affecting versions up to 11.1.4. The plugin fails to validate user permissions before allowing operations on the mlw_quiz_output_templates database table. A contributor-level authenticated user can interact with quiz output template management functions without the expected capability checks. The vulnerability enables creation, modification, and deletion of templates along with injection of unfiltered HTML content, including arbitrary script tags, which could be rendered to site administrators or quiz respondents.

Business impact

For WordPress sites relying on QSM for quizzes or surveys, this vulnerability creates a path for privilege escalation within the WordPress ecosystem. A contributor—a user tier typically granted by site owners for content creation—can alter the output display of quizzes, potentially injecting malicious scripts that execute in admin contexts or user browsers. This undermines the principle of least privilege and could lead to session hijacking, credential theft, or defacement when those templates are viewed or administered.

Affected systems

Quiz and Survey Master (QSM) WordPress plugin versions 11.1.4 and earlier. The vulnerability applies to all WordPress installations running affected plugin versions, regardless of hosting environment or WordPress configuration. The risk is proportional to how many non-administrator users have contributor access or higher.

Exploitability

Exploitation requires an authenticated WordPress account with at least contributor-level permissions. No CVSS vector indicates network accessibility (AV:N) and low attack complexity (AC:L), meaning an attacker need only log in and use standard plugin UI or API endpoints to inject content into templates. The vulnerability does not require user interaction or successful social engineering once the attacker has valid credentials.

Remediation

Update the Quiz and Survey Master plugin to a patched version released after 11.1.4 that implements proper authorization checks for template operations. Verify the fix against the plugin vendor's official advisory to confirm the version number and scope of the patch. In the interim, restrict contributor and editor roles to users who genuinely need them, and consider disabling the plugin if it is not actively used.

Patch guidance

Monitor the Quiz and Survey Master plugin repository or the vendor's security advisories for a patched release. When available, apply the update immediately to all affected WordPress installations. Before deployment, test the patched version in a staging environment to confirm quiz functionality and template rendering remain intact. Review any custom template modifications post-patch to ensure they are not lost or corrupted during the upgrade.

Detection guidance

Review WordPress user roles and permissions; identify users with contributor level or above who should not have such access. Audit the mlw_quiz_output_templates database table for recently modified or suspicious entries, particularly templates containing script tags or unusual HTML. Monitor WordPress admin and plugin activity logs for template creation, modification, or deletion events by non-administrator accounts. Consider implementing a Web Application Firewall rule to detect attempts to inject script tags into quiz output parameters.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), prioritization should account for the ease of exploitation by existing users and the insider-threat nature of the attack. Any WordPress site with multiple contributors or editors is at direct risk. The vulnerability enables stored XSS through template injection, which can compromise both administrators and end-users viewing quiz results. Organizations should patch this promptly to close the privilege-escalation vector.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects low attack complexity, network accessibility, and low privilege requirements (PR:L). However, the integrity impact (I:L) is non-negligible because unsanitized script injection into stored templates can affect multiple users. The absence of confidentiality or availability impact in the base score does not capture the secondary risk of XSS-based account compromise or data theft, which should inform internal risk prioritization above the base score alone.

Frequently asked questions