CVE-2026-14826 Quiz and Survey Master (QSM) CVE debrief

Who should care

Users of Quiz and Survey Master (QSM) WordPress plugin, especially those with contributor-level access or above, should review and apply the vendor remediation to prevent unauthorized access to quiz configurations. Additionally, operators, platform administrators, vulnerability management teams, and security teams should be aware of the potential impact and take necessary precautions to protect their environments. This includes restricting access to quiz configurations to authorized users only and monitoring for suspicious activity related to quiz configurations.

Technical summary

The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on REST routes that return a quiz's email-notification and results-page configuration. This allows users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users. The vulnerability has a CVSS score of 2.7 and is considered low-severity. Affected users should review and apply the vendor remediation to prevent unauthorized access to quiz configurations.

Defensive priority

Low-priority defensive review recommended due to limited CVSS score of 2.7 and no known ransomware campaign use.

Recommended defensive actions

• Review and apply vendor remediation for Quiz and Survey Master (QSM) WordPress plugin version 11.2.4 or later.
• Restrict access to quiz configurations to authorized users only.
• Monitor for suspicious activity related to quiz configurations.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The evidence provided is limited, primarily based on official CVE and NVD records. The vulnerability affects Quiz and Survey Master (QSM) WordPress plugin before version 11.2.4, allowing users with contributor-level access and above to read quiz configurations, including notification recipient addresses, created by other users. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. They should also check for suspicious activity related to quiz configurations and monitor for potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.