Vulnerability · Published Aug 19, 2026 · Assigned by WPScan

CVE-2026-14826Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR

Low 2.7

In plain English

A low-severity authorization bypass via user-controlled key in Quiz and Survey Master (QSM) from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.3%top 77.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Quiz and Survey Master (QSM)	0 – before 11.2.4

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/bb9cac20-4df5-4834-89f0-746a5eab20ea/ exploit, vdb-entry, technical-description