High severity · published Nov 19, 2025
CVE-2025-12426
Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.7.0.80. This is due to the plugin exposing quiz answers through the ays_quiz_check_answer AJAX action without proper authorization checks. The endpoint only validates a nonce, but that same nonce is publicly available to all site visitors via the quiz_maker_ajax_public localized script data. This makes it possible for unauthenticated attackers to extract sensitive data including quiz answers for any quiz question.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QM
Quiz Maker · ays-pro
through 6.7.0.80 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12426
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12426
Product
https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/includes/class-quiz-maker.php#L393
Product
https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L179
Product
https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.69/public/class-quiz-maker-public.php#L8490
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/bc524e3e-9b7c-47ae-ab44-c327b287b81a?source=cve
More from Quiz Maker
9.8
CVE-2025-30774
WordPress Quiz Maker plugin <= 6.6.8.7 - SQL Injection vulnerability
9.8
CVE-2024-6028
Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter
7.5
CVE-2025-58015
WordPress Quiz Maker Plugin <= 6.7.0.65 - Sensitive Data Exposure Vulnerability
7.5
CVE-2025-10042
Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection
7.5
CVE-2024-10628
Quiz Maker Business, Developer, and Agency <= (Multiple Versions) - Unauthenticated SQL Injection via id