This vulnerability involves an insecure direct object reference (IDOR) in Quiz And Survey Master versions <= 11.2.5, where unauthenticated users can bypass authorization controls by manipulating user-controlled keys. This flaw is categorized under CWE-639, indicating improper authorization checks that allow access to resources without proper validation. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, limited confidentiality impact, and no integrity or availability impact.

An unauthenticated attacker can bypass authorization mechanisms to access data or resources that should be restricted, potentially exposing sensitive information. The impact is limited to confidentiality loss without affecting integrity or availability. There are no known exploits in the wild at this time.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for unusual access patterns related to Quiz And Survey Master.