Home

Description

The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by manipulating the chained_completion_id cookie value, allowing them to alter quiz answers, scores, and results of any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.

PUBLISHED Reserved 2025-09-15 | Published 2025-09-18 | Updated 2025-09-18 | Assigner Wordfence




MEDIUM: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Default status
unaffected

* (semver)
affected

Timeline

2025-09-16:Vendor Notified
2025-09-17:Disclosed

Credits

Karuppiah Sabari Kumar finder

References

www.wordfence.com/...-1fe3-4f24-bd6b-9026e91bc5db?source=cve

plugins.trac.wordpress.org/.../1.3.3/controllers/quizzes.php

plugins.trac.wordpress.org/...uiz/tags/1.3.3/models/quiz.php

plugins.trac.wordpress.org/changeset/3362561/

plugins.trac.wordpress.org/changeset/3362701/

plugins.trac.wordpress.org/changeset/3362966/

cve.org (CVE-2025-10493)

nvd.nist.gov (CVE-2025-10493)

Download JSON