CVE-2026-79615: CWE-639 Authorization Bypass Through User-Controlled Key in Quiz and Survey Master (QSM)
Description
A vulnerability in the Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4 allows users with Contributor role or higher to access question bank entries via a REST API route without proper authorization checks. This exposure includes quiz questions, hints, and correct answer keys belonging to other users.
CVSS v3.1
Score 2.7low
Affected software
Quiz and Survey Master (QSM)
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-79615 is an authorization bypass vulnerability (CWE-639) in the Quiz and Survey Master (QSM) WordPress plugin versions prior to 11.2.4. The plugin fails to verify user authorization when returning question bank entries through a REST API endpoint, enabling users with a Contributor role to read sensitive quiz content such as questions, hints, and correct answers from other users' quizzes.
Potential Impact
Users with Contributor privileges can access quiz content that should be restricted, potentially compromising quiz integrity by exposing correct answers and hints. The impact is limited to information disclosure without integrity or availability effects. The CVSS score of 2.7 reflects a low severity due to the requirement of authenticated Contributor-level access and the limited confidentiality impact.
Mitigation Recommendations
No official fix or patch information is currently available. Users should upgrade to version 11.2.4 or later once it is released, as the vulnerability affects versions before 11.2.4. Until then, restrict Contributor role assignments or disable the affected REST API routes if possible. Monitor the vendor advisory for official remediation updates.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-25T07:42:25.726Z
- State
- PUBLISHED
Threat ID: 6a913ad4acd9273b4992fa61
Added to database: 08/28/2026, 07:37:56 UTC
Last enriched: 09/10/2026, 03:23:12 UTC
Last updated: 10/13/2026, 18:48:24 UTC
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.