CVE-2025-9294

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9294", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-20T22:35:45.725Z", "datePublished": "2026-01-06T08:21:49.006Z", "dateUpdated": "2026-04-08T16:53:30.434Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:30.434Z"}, "affected": [{"vendor": "expresstech", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "10.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results."}], "title": "Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/55895508-d0ef-4855-8d15-b8a45ba0dcb2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/admin/options-page-questions-tab.php#L1116"}, {"url": "https://research.cleantalk.org/cve-2025-9294/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-285 Improper Authorization", "cweId": "CWE-285", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-08-13T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-05T20:13:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T14:30:00.966045Z", "id": "CVE-2025-9294", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:30:11.854Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9294", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T14:30:00.966045Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:30:08.788Z"}}], "cna": {"title": "Quiz And Survey Master <= 10.3.1 - Missing Authorization to Authenticated (Subscriber+) Quiz Results Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "expresstech", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "10.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-13T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-05T20:13:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/55895508-d0ef-4855-8d15-b8a45ba0dcb2?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/admin/options-page-questions-tab.php#L1116"}], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-06T08:21:49.006Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9294", "state": "PUBLISHED", "dateUpdated": "2026-01-06T14:30:11.854Z", "dateReserved": "2025-08-20T22:35:45.725Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-06T08:21:49.006Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "vendor": "expresstech", "versions": [{"lessThanOrEqual": "10.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "7AECAB11-6DCA-4FCF-B614-133BB680CF29", "versionEndExcluding": "10.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete quiz results."}, {"lang": "es", "value": "El plugin Quiz and Survey Master (QSM) - Easy Quiz and Survey Maker para WordPress es vulnerable a la p\u00e9rdida no autorizada de datos debido a una comprobaci\u00f3n de capacidad faltante en la funci\u00f3n qsm_dashboard_delete_result en todas las versiones hasta, e incluyendo, la 10.3.1. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, eliminen resultados de cuestionarios."}], "id": "CVE-2025-9294", "lastModified": "2026-10-07T10:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9294", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:30:00.966045Z", "version": "2.0.3"}}]}, "published": "2026-01-06T09:15:55.077", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/admin/options-page-questions-tab.php#L1116"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-9294/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/55895508-d0ef-4855-8d15-b8a45ba0dcb2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T00:35:43.475895+00:00", "value": {"mitigation_remediation": ["Update Quiz and Survey Master to the latest version (10.3.2 or newer) which removes the missing capability check.", "If an immediate update is not possible, remove the 'qsm_dashboard_delete_result' capability from the Subscriber role by creating a custom role or using a role editor plugin, preventing subscribers from deleting results.", "Review existing quiz result data and restore from backups if data loss has occurred.", "Monitor the plugin's audit logs or WordPress activity logs for unexpected calls to the result deletion function."], "summary": {"action": "Patch", "impact": "Unauthorized deletion of quiz results leading to data loss"}, "threat_synthesis": {"affected_systems": "The issue affects the ExpressTech Quiz and Survey Master WordPress plugin, versions 10.3.1 and earlier.", "description_and_impact": "The QSM plugin lacks a capability check on the qsm_dashboard_delete_result function. As a result, any authenticated user with Subscriber-level access or higher can invoke this function and delete quiz results stored by the plugin. This vulnerability enables loss of user data but does not grant broader system compromise or privilege escalation. The primary impact is integrity loss of quiz result data.", "risk_and_exploitability": "The CVSS score of 4.3 categorizes this deficiency as moderate severity. An EPSS score below 1% suggests that exploitation is unlikely in the general population, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated WordPress account with at least Subscriber role, so attackers must first compromise or gain access to a legitimate user account. Once authenticated, they can run the deletion action without additional privileges, making the attack path straightforward for insiders or users who have shared credentials."}}}}, "created": "2026-01-06T14:15:47.735068+00:00", "updated": "2026-04-21T00:45:23.090847+00:00", "vendors": ["expresstech", "expresstech$PRODUCT$quiz_and_survey_master", "wordpress", "wordpress$PRODUCT$wordpress"]}