CVE-2024-1079mediumCWE-862

CVE-2024-1079: fallo de gravedad media en ays-pro Quiz Maker

Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Quiz Maker

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.5%
The Quiz Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_show_results() function in all versions up to, and including, 6.5.2.4. This makes it possible for unauthenticated attackers to fetch arbitrary quiz results which can contain PII.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
ays-pro · Quiz Maker
CVEs relacionadas — ays-pro Quiz Maker

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-6028CRITICALQuiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' ParameterEPSS 11.8%CVE-2025-10042MEDIUMQuiz Maker <= 6.7.0.56 - Unauthenticated SQL InjectionEPSS 0.9%CVE-2024-1078MEDIUMQuiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & ModificationEPSS 0.4%CVE-2025-12426MEDIUMQuiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information ExposureEPSS 0.4%CVE-2026-2384MEDIUMQuiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%