CVE-2026-14826
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
Risk Assessment
Exposure of notification recipient email addresses can violate user privacy and lead to phishing attacks.
Recommendation
Update the Quiz and Survey Master plugin to version 11.2.4 or later, which includes security fixes.
Original NVD description (English source)
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.