This vulnerability in Harmonic Design HD Quiz (versions up to 2.0.9) arises from missing authorization checks due to incorrectly configured access control security levels. It allows users with some privileges (low privileges) to access or perform actions that should be restricted. The CVSS 3.1 base score is 4.3 (medium severity), with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and limited confidentiality impact. No official patch or vendor advisory is provided, and no known exploits have been reported.

The vulnerability could allow an attacker with limited privileges to bypass access controls and gain unauthorized access to certain functionalities or data within the HD Quiz plugin. The impact is limited to confidentiality loss without affecting integrity or availability. There are no reports of active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor for updates from Harmonic Design. Until a fix is released, consider restricting access to the plugin to trusted users only and review user privileges to minimize exposure.