CVE-2026-14826 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR
Contributors can read other users' quiz email and results configurations, exposing recipient addresses, due to missing ownership checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14826?
CVE-2026-14826 is a low-severity missing authorization vulnerability in Unknown Quiz and Survey Master (QSM), published on 19 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including notification recipient addresses, of quizzes created by other users.
Weakness: CWE-639
Which versions are affected by CVE-2026-14826?
How do I fix CVE-2026-14826?
No fix has been published for CVE-2026-14826 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-14826 being exploited?
There is no known exploitation of CVE-2026-14826 in the wild and no public exploit code.
Sources
Also known as GHSA-28r4-82c9-hfh7.