CVE-2025-12426 – The Quiz Maker WordPress plugin exposes quiz an... (How to Fix)

Q: What is the severity of CVE-2025-12426?

CVE-2025-12426 has a CVSS score of 5.3 (MEDIUM). The Quiz Maker WordPress plugin exposes quiz answers to unauthenticated attackers through an AJAX endpoint with insufficient authorization. This vulnerability allows anyone to extract sensitive quiz data from any quiz on affected sites. All WordPress sites using Quiz Maker versions up to 6.7.0.80 are affected.

📋 TL;DR

The Quiz Maker WordPress plugin exposes quiz answers to unauthenticated attackers through an AJAX endpoint with insufficient authorization. This vulnerability allows anyone to extract sensitive quiz data from any quiz on affected sites. All WordPress sites using Quiz Maker versions up to 6.7.0.80 are affected.

💻 Affected Systems

Products:

Quiz Maker WordPress Plugin

Versions: All versions up to and including 6.7.0.80

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with vulnerable Quiz Maker plugin versions are affected regardless of configuration.

📦 What is this software?

Quiz Maker by Ays Pro

View all CVEs affecting Quiz Maker →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers harvest all quiz answers, compromising intellectual property, training materials, or assessment content, potentially leading to data breaches or competitive advantage loss.

🟠

Likely Case

Unauthenticated users extract quiz answers to cheat on assessments, bypass learning verification, or gather proprietary content.

🟢

If Mitigated

With proper access controls, only authorized users can access quiz answers, maintaining assessment integrity and data confidentiality.

🌐 Internet-Facing: HIGH - The vulnerability is exploitable by unauthenticated attackers via public endpoints, affecting any internet-facing WordPress site with the plugin.

🏢 Internal Only: MEDIUM - Internal sites are still vulnerable but have reduced attack surface compared to internet-facing deployments.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires minimal technical skill - attackers can craft HTTP requests to the vulnerable AJAX endpoint using publicly available nonce values.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 6.7.0.81 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3200000%40quiz-maker%2Ftrunk&old=3199999%40quiz-maker%2Ftrunk

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Quiz Maker plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download latest version from WordPress plugin repository and manually update.

🔧 Temporary Workarounds

Disable Quiz Maker Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate quiz-maker

Restrict AJAX Endpoint Access

linux

Block access to the vulnerable AJAX endpoint via web application firewall or .htaccess

# Add to .htaccess:
RewriteCond %{QUERY_STRING} ays_quiz_check_answer [NC]
RewriteRule ^wp-admin/admin-ajax\.php$ - [F,L]

🧯 If You Can't Patch

Implement web application firewall rules to block requests containing 'ays_quiz_check_answer' parameter
Monitor for unusual AJAX requests to admin-ajax.php with quiz-related parameters

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Quiz Maker → Version. If version is 6.7.0.80 or lower, system is vulnerable.

Check Version:

wp plugin get quiz-maker --field=version

Verify Fix Applied:

After updating, verify plugin version is 6.7.0.81 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Multiple POST requests to /wp-admin/admin-ajax.php with 'action=ays_quiz_check_answer' parameter
Unusual AJAX requests from unauthenticated IP addresses

Network Indicators:

HTTP POST requests to admin-ajax.php with quiz answer parameters
Traffic patterns showing systematic extraction of quiz data

SIEM Query:

source="web_logs" AND uri_path="/wp-admin/admin-ajax.php" AND query_string="*ays_quiz_check_answer*"

📊 Metadata

CVE ID: CVE-2025-12426

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE: CWE-200

EPSS Score: 0.08% exploit probability (24.3th percentile)

Published: November 19, 2025

Last Updated: December 12, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-12426, you might also want to check these: