Auth bypass in Expresstech Quiz And Survey Master
CVE-2025-9637
The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability and status checks on multiple functions in all versions up to, and including, 10.3.1. This makes it possible for unauthenticated attackers to view the details of unpublished, private, or password-protected quizzes, as well as submit file responses to questions from those quizzes, which allow file upload.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (16.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 16.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.000
Affected products
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/88a9abf4-62a9-4695-87e7-18ff0… (Third Party Advisory)
- plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/cla… (Product)
- plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/classes/cla… (Product)
- plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.2.6/php/rest-api.php (Product)
Frequently asked questions
- What is CVE-2025-9637?
- CVE-2025-9637 is a medium-severity vulnerability in Expresstech Quiz And Survey Master, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-01-06.
- How severe is CVE-2025-9637?
- Medium severity. CVSS v3 base score is 6.5 out of 10.