{"apiVersion":"1.0","identifier":"CVE-2026-79615","description":"The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API routes, allowing users with a role as low as Contributor to read the questions, hints and correct answer keys of quizzes belonging to other users.","publishedAt":"2026-08-28T08:16:42","lastModifiedAt":"2026-08-28T16:18:27","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79615","cvssScore":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","epssProbability":0.00142,"riskScore":0.27,"affectedProduct":"Quiz and Survey Master","affectedVersions":"<11.2.4","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-79615","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-79615","en":"https://www.redsauce.net/en/cves/CVE-2026-79615","fr":"https://www.redsauce.net/fr/cves/CVE-2026-79615","pt":"https://www.redsauce.net/pt/cves/CVE-2026-79615","de":"https://www.redsauce.net/de/cves/CVE-2026-79615","sk":"https://www.redsauce.net/sk/cves/CVE-2026-79615","el":"https://www.redsauce.net/el/cves/CVE-2026-79615"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-79615"}}