{"id":"CVE-2026-125787","kind":"vulnerability","aliases":["CVE-2026-125787"],"related":[],"title":"Quiz And Survey Master WordPress plugin: missing authorization check lets users bypass access control","description":"Missing Authorization vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through 11.3.0.","summary":"Quiz And Survey Master, a WordPress plugin by ExpressTech, has a missing authorization check in its access control. The sources do not say what data or actions an attacker gains beyond bypassing the intended permission levels.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","quiz-master-next","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed version of the Quiz And Survey Master plugin (quiz-master-next) in the WordPress admin plugin list; the sources say versions through `11.3.0` are affected.","fix":null,"status":"open","published_at":"2026-11-12T01:17:11+00:00","first_seen_at":"2026-11-12T01:39:26+00:00","triaged_at":"2026-11-12T01:40:12+00:00","updated_at":"2026-11-12T01:40:12+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-12T01:40:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Quiz And Survey Master WordPress plugin: missing authorization check lets users bypass access control","impact":"medium","summary":"Quiz And Survey Master, a WordPress plugin by ExpressTech, has a missing authorization check in its access control. The sources do not say what data or actions an attacker gains beyond bypassing the intended permission levels.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","quiz-master-next"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access-control bypass in a WordPress quiz plugin","analyst_note":"Confirm the fixed version and the exact unauthorized action from the vendor or the Wordfence/NVD entry for quiz-master-next.","how_to_check":"- Check the installed version of the Quiz And Survey Master plugin (quiz-master-next) in the WordPress admin plugin list; the sources say versions through `11.3.0` are affected.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running Quiz And Survey Master (quiz-master-next) through version 11.3.0 may be exposed to bypassing its access control settings. The sources do not say which roles or configurations are required, so whether a site is exposed beyond the affected version range is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4550,"output_tokens":523,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125787':17A,20A '-2026':16A,19A '11.3.0':93C 'access':13A,43B,80C 'action':53B 'affect':85C 'allow':76C 'attack':55B 'author':8A,39B,64C 'beyond':57B 'bypass':12A,58B 'check':9A,40B 'configur':79C 'control':14A,44B,81C 'cve':15A,18A 'data':51B 'exploit':77C 'expresstech':35B,67C 'gain':56B 'incorrect':78C 'intend':60B 'issu':84C 'let':10A 'level':62B 'levels.this':83C 'master':4A,24B,30B,71C,74C,89C 'miss':7A,38B,63C 'n/a':91C 'next':25B,75C 'packag':21B 'permiss':61B 'plugin':6A,33B 'quiz':1A,23B,27B,68C,73C,86C 'quiz-master-next':22B,72C 'say':49B 'secur':82C 'sourc':46B 'survey':3A,29B,70C,88C 'user':11A 'vulner':65C 'wordpress':5A,26B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running Quiz And Survey Master (quiz-master-next) through version 11.3.0 may be exposed to bypassing its access control settings. The sources do not say which roles or configurations are required, so whether a site is exposed beyond the affected version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","quizmasternext","wordpress"],"campaign_type":null,"search_a":"'-125787':17A,20A '-2026':16A,19A 'access':13A 'author':8A 'bypass':12A 'check':9A 'control':14A 'cve':15A,18A 'let':10A 'master':4A 'miss':7A 'plugin':6A 'quiz':1A 'survey':3A 'user':11A 'wordpress':5A","search_b":"'access':43B 'action':53B 'attack':55B 'author':39B 'beyond':57B 'bypass':58B 'check':40B 'control':44B 'data':51B 'expresstech':35B 'gain':56B 'intend':60B 'level':62B 'master':24B,30B 'miss':38B 'next':25B 'packag':21B 'permiss':61B 'plugin':33B 'quiz':23B,27B 'quiz-master-next':22B 'say':49B 'sourc':46B 'survey':29B 'wordpress':26B,32B","search_c":"'11.3.0':93C 'access':80C 'affect':85C 'allow':76C 'author':64C 'configur':79C 'control':81C 'exploit':77C 'expresstech':67C 'incorrect':78C 'issu':84C 'levels.this':83C 'master':71C,74C,89C 'miss':63C 'n/a':91C 'next':75C 'quiz':68C,73C,86C 'quiz-master-next':72C 'secur':82C 'survey':70C,88C 'vulner':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T01:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125787","severity":null,"published_at":"2026-11-12T01:17:11+00:00","modified_at":"2026-11-12T01:17:11+00:00","first_seen_at":"2026-11-12T01:39:26+00:00","fetched_at":"2026-11-12T01:39:26+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}