CVE-2025-9637 is a missing authorization vulnerability in the expresstech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker WordPress plugin. Due to absent capability and status checks on multiple functions, unauthenticated users can view sensitive quiz content that should be restricted (unpublished, private, or password-protected quizzes) and submit file uploads in response to quiz questions. This vulnerability affects all versions up to and including 10.3.1. The CVSS 3.1 score is 6.5 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts without availability impact.

An unauthenticated attacker can bypass authorization controls to access restricted quiz content and submit file uploads. This could lead to unauthorized disclosure of quiz data and potentially malicious file uploads, which may pose security risks depending on how uploaded files are handled by the system. There is no indication of availability impact or known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the plugin or disabling it if possible. Monitor for vendor updates and apply patches promptly once released.