CVE-2025-9637

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9637", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-28T20:48:10.672Z", "datePublished": "2026-01-06T09:20:58.732Z", "dateUpdated": "2026-04-08T17:05:18.153Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:18.153Z"}, "affected": [{"vendor": "expresstech", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "10.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload."}], "title": "Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88a9abf4-62a9-4695-87e7-18ff0b0075e9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L281"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L1987"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rahul Sreenivasan"}], "timeline": [{"time": "2025-08-19T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-05T20:24:52.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T14:18:50.325082Z", "id": "CVE-2025-9637", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:19:15.096Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9637", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T14:18:50.325082Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:19:06.752Z"}}], "cna": {"title": "Quiz and Survey Master (QSM) <= 10.3.1 - Missing Authorization to Unpublished, Private And Password-Protected Quiz Information Disclosure And Image Response Uploads", "credits": [{"lang": "en", "type": "finder", "value": "Rahul Sreenivasan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "expresstech", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "10.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-19T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-05T20:24:52.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88a9abf4-62a9-4695-87e7-18ff0b0075e9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L281"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L1987"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php"}], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:05:18.153Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9637", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:05:18.153Z", "dateReserved": "2025-08-28T20:48:10.672Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-06T09:20:58.732Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "vendor": "expresstech", "versions": [{"lessThanOrEqual": "10.3.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:expresstech:quiz_and_survey_master:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "7AECAB11-6DCA-4FCF-B614-133BB680CF29", "versionEndExcluding": "10.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload."}, {"lang": "es", "value": "El plugin Quiz and Survey Master (QSM) - Easy Quiz and Survey Maker para WordPress es vulnerable a acceso no autorizado y modificaci\u00f3n de datos debido a la falta de comprobaciones de capacidad y estado en m\u00faltiples funciones en todas las versiones hasta e incluyendo la 10.3.1. Esto hace posible que atacantes no autenticados vean los detalles de cuestionarios no publicados, privados o protegidos con contrase\u00f1a, as\u00ed como enviar respuestas de archivos a preguntas de esos cuestionarios que permiten la carga de archivos."}], "id": "CVE-2025-9637", "lastModified": "2026-10-07T10:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9637", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:18:50.325082Z", "version": "2.0.3"}}]}, "published": "2026-01-06T10:15:48.940", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L1987"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/class-qmn-quiz-manager.php#L281"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/88a9abf4-62a9-4695-87e7-18ff0b0075e9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T03:49:20.047701+00:00", "value": {"mitigation_remediation": ["Apply the latest QSM plugin release that includes the missing capability and status checks.", "If an update cannot be applied immediately, block or protect the plugin\u2019s public upload and data\u2011retrieval endpoints by implementing a web\u2011application firewall rule or by limiting access to authorized user roles through .htaccess.", "Configure WordPress and the QSM plugin to restrict the types of files that can be uploaded, and ensure all uploads are scanned for malware before being accepted."], "summary": {"action": "Patch Now", "impact": "Unauthorized Data Disclosure"}, "threat_synthesis": {"affected_systems": "The issue affects all installations of ExpressTech\u2019s Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker from version 10.3.1 backward. Any WordPress site that has the plugin enabled and has not applied the latest patch is vulnerable. The problem is confined to the plugin within the WordPress environment; no other WordPress components are directly impacted.", "description_and_impact": "The vulnerability in the Quiz and Survey Master plugin results from missing capability and status checks on several functions. This oversight allows any visitor, including unauthenticated users, to retrieve full details of unpublished, private, or password\u2011protected quizzes and to submit arbitrary file responses to quiz questions. The exposed quiz content and the ability to upload files can lead to data disclosure and potential malicious payload delivery.", "risk_and_exploitability": "The CVSS v3.1 base score of 6.5 reflects a moderate level of severity, and the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not catalogued in the CISA KEV. Attackers can likely exploit the flaw by requesting quiz data or uploading files through the plugin\u2019s publicly reachable endpoints, as no authorization is enforced. Successful exploitation would compromise the confidentiality of quiz content and could allow the storage of malicious files on the server, presenting integrity and resource\u2011exhaustion risks."}}}}, "created": "2026-01-06T14:15:48.946522+00:00", "updated": "2026-04-22T04:00:07.979574+00:00", "vendors": ["expresstech", "expresstech$PRODUCT$quiz_and_survey_master", "wordpress", "wordpress$PRODUCT$wordpress"]}