CVE-2025-12426

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12426", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-28T18:42:24.408Z", "datePublished": "2025-11-19T04:28:19.408Z", "dateUpdated": "2026-04-08T17:18:43.460Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:43.460Z"}, "affected": [{"vendor": "ays-pro", "product": "Quiz Maker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.7.0.80", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possible for unauthenticated attackers to extract sensitive data including quiz answers for any quiz question."}], "title": "Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc524e3e-9b7c-47ae-ab44-c327b287b81a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L8490"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/includes/class-quiz-maker.php#L393"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L179"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-10-29T16:53:53.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-18T15:41:24.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T20:11:30.708052Z", "id": "CVE-2025-12426", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T20:11:52.850Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12426", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T20:11:30.708052Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T20:11:42.165Z"}}], "cna": {"title": "Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "ays-pro", "product": "Quiz Maker", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.7.0.80"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-29T16:53:53.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-18T15:41:24.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc524e3e-9b7c-47ae-ab44-c327b287b81a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L8490"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/includes/class-quiz-maker.php#L393"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L179"}], "descriptions": [{"lang": "en", "value": "The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possible for unauthenticated attackers to extract sensitive data including quiz answers for any quiz question."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:43.460Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12426", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:18:43.460Z", "dateReserved": "2025-10-28T18:42:24.408Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-19T04:28:19.408Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Quiz Maker", "vendor": "ays-pro", "versions": [{"lessThanOrEqual": "6.7.0.80", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ays-pro:quiz_maker:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "C4BE7F00-6234-4268-908E-D13A380F8E54", "versionEndExcluding": "6.7.0.81", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possible for unauthenticated attackers to extract sensitive data including quiz answers for any quiz question."}, {"lang": "es", "value": "El plugin Quiz Maker para WordPress es vulnerable a la Exposici\u00f3n de Informaci\u00f3n Sensible en todas las versiones hasta la 6.7.0.80, inclusive. Esto se debe a que el plugin expone las respuestas del cuestionario a trav\u00e9s de la acci\u00f3n AJAX 'ays_quiz_check_answer' sin las comprobaciones de autorizaci\u00f3n adecuadas. El endpoint solo valida un nonce, pero ese mismo nonce est\u00e1 disponible p\u00fablicamente para todos los visitantes del sitio a trav\u00e9s de los datos del script localizado 'quiz_maker_ajax_public'. Esto hace posible que atacantes no autenticados extraigan datos sensibles, incluyendo las respuestas del cuestionario, para cualquier pregunta del cuestionario."}], "id": "CVE-2025-12426", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12426", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-19T20:11:30.708052Z", "version": "2.0.3"}}]}, "published": "2025-11-19T05:16:02.477", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/includes/class-quiz-maker.php#L393"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L179"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L8490"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bc524e3e-9b7c-47ae-ab44-c327b287b81a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:12:09.337666+00:00", "value": {"mitigation_remediation": ["Check for updates or patches from ays-pro for Quiz Maker; install the latest version if available.", "If updating is not an immediate option, restrict unauthenticated access to the ays_quiz_check_answer AJAX action, for example by adding a firewall rule or configuration in your web server.", "Add or ensure proper authorization checks on the AJAX endpoint to validate user permissions before returning quiz answers."], "summary": {"action": "Immediate Patch", "impact": "Sensitive Information Exposure"}, "threat_synthesis": {"affected_systems": "This issue affects WordPress sites that have installed the ays\u2011pro Quiz Maker plugin, specifically versions 6.7.0.80 and earlier. Sites using the plugin via the official repository or downloading older releases are vulnerable. No specific WordPress core version is required; the flaw resides entirely within the plugin\u2019s code.", "description_and_impact": "The Quiz Maker plugin for WordPress is susceptible to a Sensitive Information Exposure vulnerability in all releases up to 6.7.0.80. The flaw allows unauthenticated users to retrieve quiz answers via the ays_quiz_check_answer AJAX action, which only validates a nonce that is openly available to anyone visiting the site. Without proper authorization checks, an attacker can obtain the correct answers for any quiz question, compromising the confidentiality of test content and potentially giving undue advantage to malicious participants. The weakness is classified as CWE\u2011200. The impact is that any visitor can access protected quiz data without legitimate credentials, thereby exposing confidential or proprietary information.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. EPSS is listed as < 1%, suggesting a very low probability of exploitation at present. The vulnerability is not featured in the CISA KEV catalog. The attack surface is broad because any site visitor can discover the nonce and then call the AJAX action, meaning a threat actor only needs simple automated requests to harvest quiz answers. While the exploitation requires no privileged access, the data leakage can have significant consequences for educational or assessment platforms that rely on quiz integrity."}}}}, "created": "2025-11-20T10:30:48.226683+00:00", "updated": "2026-04-21T18:15:36.377743+00:00", "vendors": ["ays-pro", "ays-pro$PRODUCT$quiz_maker", "wordpress", "wordpress$PRODUCT$wordpress"]}