An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Quiz Master Next Plugin | — | Update quiz-master-next plugin to version 7.0.1, or a newer patched version | May 15, 2025 | Aug 3, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub