CVE-2026-14820 describes an information exposure vulnerability (CWE-200) in the Quiz and Survey Master (QSM) WordPress plugin prior to version 11.1.3. The plugin does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality. Additionally, it returns distinct responses for valid and invalid usernames, enabling unauthenticated attackers to enumerate valid usernames and perform password brute-force attacks while bypassing brute-force protections.

An attacker can enumerate valid usernames and attempt password brute-force attacks without triggering standard brute-force protections. This could lead to unauthorized access if weak passwords are used. The confidentiality of user account information is partially compromised due to username enumeration. There is no direct impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a patch is available, consider implementing external rate limiting and monitoring to mitigate brute-force attempts.