CVE-2025-9294 Expresstech CVE debrief

Who should care

Defenders responsible for WordPress installations with the Quiz and Survey Master plugin should assess exposure and prioritize patching vulnerable versions. This includes reviewing and updating security configurations, monitoring for unauthorized data modifications, and ensuring that access to sensitive functions is properly restricted. Additionally, defenders should consider implementing compensating controls for exposed systems while remediation is being

Why it matters

CVE-2025-9294 allows authenticated attackers with Subscriber-level access to delete quiz results in the Quiz and Survey Master plugin for WordPress, potentially leading to data loss or integrity issues. Defenders should prioritize verifying and patching vulnerable plugin versions, restricting access to sensitive functions, and monitoring for unauthorized data modifications.

• Authenticated attackers with Subscriber-level access can delete quiz results
• Potential data loss or integrity issues
• Need for verification and patching of vulnerable plugin versions
• Monitoring for unauthorized data modifications

Technical summary

The Quiz and Survey Master plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1. This vulnerability allows authenticated attackers with Subscriber-level access and above to delete quiz results, potentially leading to data loss or integrity issues. The issue has a CVSS score of 4.3 and is classified as MEDIUM severity. Defenders should prioritize verifying and patching vulnerable plugin versions, restricting access to sensitive functions, and monitoring for unauthorized data modifications.

Defensive priority

Defenders should prioritize verifying and patching vulnerable plugin versions, restricting access to sensitive functions, and monitoring for unauthorized data modifications.

Recommended defensive actions

• Verify and patch vulnerable plugin versions
• Restrict access to sensitive functions
• Monitor for unauthorized data modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by a missing capability check on the qsm_dashboard_delete_result function in all versions up to, and including, 10.3.1 of the Quiz and Survey Master plugin. This capability check omission allows authenticated attackers with Subscriber-level access and above to delete quiz results. The issue was identified and reported through responsible disclosure channels. Defenders should verify and patch vulnerable plugin versions, restrict access to sensitive functions, and monitor for unauthorized data modifications.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.