CVE-2026-14820 Quiz and Survey Master CVE debrief

Who should care

Defenders of WordPress installations using the Quiz and Survey Master (QSM) plugin should assess their exposure and take steps to protect against potential enumeration and brute-force attacks. This includes verifying plugin versions, implementing additional security measures, and monitoring for suspicious login attempts.

Technical summary

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 is vulnerable to unauthenticated enumeration of valid usernames and brute-force attacks against passwords due to a lack of rate limiting and standard failed-login auditing on its front-end credential-check functionality. The plugin's credential-check functionality returns distinct responses for valid and invalid accounts, which can be exploited by attackers to bypass brute-force protection mechanisms. This issue can be addressed by upgrading to version 11.1.3 or later.

Defensive priority

Medium

Recommended defensive actions

• Inventory and assess WordPress installations using the Quiz and Survey Master (QSM) plugin
• Verify the plugin version and upgrade to 11.1.3 or later if necessary
• Implement additional security measures such as rate limiting and IP blocking
• Monitor for suspicious login attempts and implement alerting mechanisms
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; primary official records indicate vulnerability in Quiz and Survey Master (QSM) WordPress plugin before 11.1.3. Vendor remediation status is unknown. Defenders should verify plugin versions and assess exposure. Limited source detail suggests enumeration and brute-force attacks are possible.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.