CVE-2026-14821

A Missing Authorization vulnerability exists in the WordPress Quiz and Survey Master (QSM) plugin in versions prior to 11.1.5. The plugin fails to perform necessary capability checks on the output template deletion endpoint, allowing authenticated users with Contributor-level access or higher to delete arbitrary output templates.

This vulnerability is classified under OWASP A1: Broken Access Control (CWE-862: Missing Authorization) and allows low-privileged users to delete customized quiz/survey output templates, disrupting site layout and functionality.

Quiz and Survey Master is a popular WordPress quiz creation plugin. In affected versions before 11.1.5, the AJAX handler processing template deletion failed to verify user capabilities before triggering the template deletion routine.

As a result, any authenticated user holding at least the Contributor role can craft a request to delete custom quiz output templates created by administrators.

Attack vector: Authenticated network request from a Contributor account targeting the unprotected template deletion action.

• Unauthorized deletion of customized quiz and survey output templates
• Disruption of active quizzes and survey results presentation
• Potential loss of unbacked-up template configurations

Update Quiz and Survey Master (QSM) to version 11.1.5 or later. The patch adds proper capability checks (`manage_options` / `edit_posts` validation) prior to performing template deletion.