Plugin WordPress Quiz Maker <= 6.7.1.2 - Vulnérabilité Cross Site Request Forgery (CSRF)
Plateforme
wordpress
Composant
quiz-maker
Corrigé dans
6.7.2
CVE-2026-32342 describes a Cross-Site Request Forgery (CSRF) vulnerability discovered in the Quiz Maker WordPress plugin. This flaw allows an attacker to trick a logged-in user into performing actions they did not intend to, potentially leading to unauthorized modifications or deletions of quiz data. The vulnerability impacts versions from 0.0.0 up to and including 6.7.1.2, and a patch is available in version 6.7.1.3.
Détecte cette CVE dans ton projet
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.
Impact et Scénarios d'Attaquetraduction en cours…
A successful CSRF attack could allow an attacker to modify quiz settings, delete quizzes, or even gain access to user accounts associated with the plugin. The attacker would need to craft a malicious request and entice the victim to click a link or visit a webpage containing the crafted request. The impact is amplified if the plugin is used in environments with sensitive quiz data or if user accounts have elevated privileges. While not directly leading to system compromise, CSRF can be a stepping stone for further attacks if combined with other vulnerabilities.
Contexte d'Exploitationtraduction en cours…
CVE-2026-32342 was publicly disclosed on 2026-03-13. There are currently no publicly available proof-of-concept exploits. The EPSS score is pending evaluation. Monitor security advisories and threat intelligence feeds for any indications of active exploitation.
Qui Est à Risquetraduction en cours…
Websites utilizing the Quiz Maker plugin, particularly those with user-generated quiz content or sensitive data, are at risk. Shared hosting environments where plugin updates are managed centrally are also vulnerable if they haven't applied the patch.
Étapes de Détectiontraduction en cours…
• wordpress / composer / npm:
grep -r 'ays_pro_quiz_maker' /var/www/html/wp-content/plugins/
wp plugin list | grep 'Quiz Maker'• generic web:
curl -I https://your-wordpress-site.com/ays-pro-quiz-maker/ | grep 'Server'Chronologie de l'Attaque
- Disclosure
disclosure
Renseignement sur les Menaces
Statut de l'Exploit
EPSS
0.02% (percentile 3%)
Vecteur CVSS
Que signifient ces métriques?
- Attack Vector
- Réseau — exploitable à distance via internet. Aucun accès physique ou local requis.
- Attack Complexity
- Faible — aucune condition spéciale requise. Exploitable de manière fiable.
- Privileges Required
- Aucun — sans authentification. Aucune identifiant requis pour exploiter.
- User Interaction
- Requise — la victime doit ouvrir un fichier, cliquer sur un lien ou visiter une page.
- Scope
- Inchangé — impact limité au composant vulnérable.
- Confidentiality
- Aucun — aucun impact sur la confidentialité.
- Integrity
- Faible — l'attaquant peut modifier certaines données avec un impact limité.
- Availability
- Aucun — aucun impact sur la disponibilité.
Logiciel Affecté
Informations sur le paquet
- Installations actives
- 20KPopulaire
- Note du plugin
- 4.9
- Nécessite WordPress
- 4.0+
- Compatible jusqu'à
- 7.0
- Nécessite PHP
- 7.0+
Classification de Faiblesse (CWE)
Chronologie
- Réservé
- Publiée
- Modifiée
- EPSS mis à jour
Mitigation et Contournementstraduction en cours…
The primary mitigation for CVE-2026-32342 is to immediately upgrade the Quiz Maker plugin to version 6.7.1.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) with CSRF protection rules. Additionally, ensure that all user input is properly validated and sanitized to prevent malicious data from being processed. Implement strict content security policies (CSP) to restrict the sources from which scripts can be executed.
Comment corriger
Mettre à jour vers la version 6.7.1.3, ou une version corrigée plus récente
Newsletter Sécurité CVE
Analyses de vulnérabilités et alertes critiques directement dans votre boîte mail.
Questions fréquentestraduction en cours…
What is CVE-2026-32342 — CSRF in Quiz Maker WordPress Plugin?
CVE-2026-32342 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Quiz Maker WordPress plugin, allowing attackers to perform unauthorized actions.
Am I affected by CVE-2026-32342 in Quiz Maker WordPress Plugin?
You are affected if you are using Quiz Maker versions 0.0.0 through 6.7.1.2. Upgrade to 6.7.1.3 or later to mitigate the risk.
How do I fix CVE-2026-32342 in Quiz Maker WordPress Plugin?
Upgrade the Quiz Maker plugin to version 6.7.1.3 or later. Consider WAF rules and CSP as temporary mitigations if immediate upgrade is not possible.
Is CVE-2026-32342 being actively exploited?
Currently, there are no publicly known active exploitation campaigns, but monitoring is advised.
Where can I find the official Quiz Maker advisory for CVE-2026-32342?
Refer to the official Quiz Maker website or WordPress plugin repository for the latest advisory and update information.
Ton projet est-il affecté ?
Téléverse ton fichier de dépendances et découvre instantanément si cette CVE et d'autres te touchent.