CVE-2025-10493: CWE-639 Authorization Bypass Through User-Controlled Key in prasunsen Chained Quiz
The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by manipulating the chained_completion_id cookie value, allowing them to alter quiz answers, scores, and results of any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.
AI Analysis
Technical Summary
CVE-2025-10493 is an authorization bypass vulnerability (CWE-639) in the Chained Quiz plugin for WordPress. The issue arises from insecure direct object references caused by missing validation on a user-controlled key (chained_completion_id cookie). This allows unauthenticated attackers to hijack and modify quiz attempts of other users by manipulating this cookie value. The vulnerability affects version 1.3.4 and earlier. Partial patches were introduced in versions 1.3.4 and 1.3.5, but the patch status is not fully confirmed. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with no privileges required and low complexity.
Potential Impact
An attacker can alter quiz answers, scores, and results of any user without authentication by exploiting the missing validation on the chained_completion_id cookie. This compromises the integrity of quiz data but does not impact confidentiality or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Partial patches exist in versions 1.3.4 and 1.3.5, but the full remediation status is not confirmed. Users should upgrade to the latest plugin version once a complete fix is released. Until then, monitor vendor advisories for updates. No official patch link is provided, so verify with the vendor for current remediation guidance.
CVE-2025-10493: CWE-639 Authorization Bypass Through User-Controlled Key in prasunsen Chained Quiz
Description
The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by manipulating the chained_completion_id cookie value, allowing them to alter quiz answers, scores, and results of any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-10493 is an authorization bypass vulnerability (CWE-639) in the Chained Quiz plugin for WordPress. The issue arises from insecure direct object references caused by missing validation on a user-controlled key (chained_completion_id cookie). This allows unauthenticated attackers to hijack and modify quiz attempts of other users by manipulating this cookie value. The vulnerability affects version 1.3.4 and earlier. Partial patches were introduced in versions 1.3.4 and 1.3.5, but the patch status is not fully confirmed. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with no privileges required and low complexity.
Potential Impact
An attacker can alter quiz answers, scores, and results of any user without authentication by exploiting the missing validation on the chained_completion_id cookie. This compromises the integrity of quiz data but does not impact confidentiality or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Partial patches exist in versions 1.3.4 and 1.3.5, but the full remediation status is not confirmed. Users should upgrade to the latest plugin version once a complete fix is released. Until then, monitor vendor advisories for updates. No official patch link is provided, so verify with the vendor for current remediation guidance.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-09-15T17:13:39.985Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 68cc13c146e444568e341cb9
Added to database: 9/18/2025, 2:14:25 PM
Last enriched: 4/9/2026, 8:46:48 PM
Last updated: 5/10/2026, 2:51:45 AM
Views: 155
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.