CVE-2025-12426 — Sensitive Information Exposure in Quiz Maker

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
7.5HIGHNVD
CNA5.3
EPSS
0.1%
top 72.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Ays-pro Quiz Maker
Timeline
PublishedNov 19

Description

The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possible for unauthenticated attackers to extract sensitive data incl…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDays-pro/quiz_maker< 6.7.0.81
▶CVEListV5ays-pro/quiz_maker6.7.0.80

🔴Vulnerability Details

2
GHSA
GHSA-f657-rq9j-v8vf: The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6↗2025-11-19
▶
CVEList
Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure↗2025-11-19
▶
CVE-2025-12426 — Sensitive Information Exposure | cvebase