The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.
History

Sat, 28 Dec 2024 01:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2023-06-09T05:33:19.875Z

Updated: 2024-12-28T00:51:57.705Z

Reserved: 2023-01-13T16:54:28.658Z

Link: CVE-2023-0291

cve-icon Vulnrichment

Updated: 2024-08-02T05:02:44.183Z

cve-icon NVD

Status : Modified

Published: 2023-06-09T06:15:48.630

Modified: 2024-11-21T07:36:54.460

Link: CVE-2023-0291

cve-icon Redhat

No data.