PT-2025-47427 · WordPress · Quiz Maker

Rafshanzani Suhada · Published 2025-11-19 · Updated 2025-11-19 · CVE-2025-12426

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quiz Maker plugin for WordPress versions up to and including 6.7.0.80

Description The Quiz Maker plugin for WordPress is affected by a sensitive information exposure issue. The plugin exposes quiz answers through the ays quiz check answer API endpoint without proper authorization checks. The endpoint validates a nonce, but this nonce is publicly available to all site visitors through the quiz maker ajax public localized script data. This allows unauthenticated attackers to extract sensitive data, including quiz answers for any quiz question.

Recommendations Update the Quiz Maker plugin to a version beyond 6.7.0.80.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-12426

Affected Products

Quiz Maker

References · 10

• https://osv.dev/vulnerability/CVE-2025-12426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12426 · Security Note
• https://twitter.com/VulmonFeeds/status/1991094646110372098 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bc524e3e-9b7c-47ae-ab44-c327b287b81a?source=cve · Note
• https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/includes/class-quiz-maker.php#L393 · Note
• https://twitter.com/CVEnew/status/1991042920556671103 · Twitter Post
• https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L8490 · Note
• https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L179 · Note
• https://t.me/cveNotify/143301 · Telegram Post
• https://t.me/CVEtracker/37709 · Telegram Post