PT-2025-1595 · WordPress · The Quiz Maker Business+2

Abrahack · Published 2025-01-25 · Updated 2025-01-26 · CVE-2024-10574

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Quiz Maker Business plugin for WordPress versions up to, and including, 8.8.0 The Quiz Maker Developer plugin for WordPress versions up to, and including, 21.8.0 The Quiz Maker Agency plugin for WordPress versions up to, and including, 31.8.0

Description The issue is related to unauthorized modification of data due to a missing capability check on the ays save google credentials function. This allows unauthenticated attackers to modify the Google Sheets integration credentials within the plugin's settings. Additionally, because the client id parameter is not sanitized or escaped when used in output, this could also be leveraged to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Recommendations The Quiz Maker Business plugin for WordPress versions up to, and including, 8.8.0 should update to a version higher than 8.8.0 to resolve the issue. The Quiz Maker Developer plugin for WordPress versions up to, and including, 21.8.0 should update to a version higher than 21.8.0 to resolve the issue. The Quiz Maker Agency plugin for WordPress versions up to, and including, 31.8.0 should update to a version higher than 31.8.0 to resolve the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-05980

CVE-2024-10574

Affected Products

Quiz Maker Agency

The Quiz Maker Business

The Quiz Maker Developer

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2024-10574 · Security Note
• https://bdu.fstec.ru/vul/2025-05980 · Security Note
• https://t.me/cvedetector/16411 · Telegram Post
• https://ays-pro.com/wordpress/quiz-maker · Note
• https://twitter.com/VulmonFeeds/status/1883411752286593101 · Twitter Post
• https://t.me/cvenotify/108627 · Telegram Post
• https://twitter.com/CVEnew/status/1883387296743108918 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1883446173035381107 · Twitter Post
• https://twitter.com/theabrahack/status/1883196214981878268 · Twitter Post
• https://twitter.com/CVETracker/status/1883606018178912388 · Twitter Post
• https://wiz.io/vulnerability-database/cve/cve-2024-10574 · Note
• https://ays-pro.com/changelog-for-quiz-maker-pro · Note
• https://twitter.com/WolfgangSesin/status/1883446173052109037 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/detail/quiz-maker-business-developer-and-agency-multiple-versions-missing-authorization-to-google-sheets-integration-credentials-modification-and-stored-cross-site-scripting · Note
• https://vuldb.com/?id.293464 · Note