CVE-2020-35951

CRITICAL NUCLEI

Quiz and Survey Master < 7.0.1 - Unauthenticated Arbitrary File Deletion via qsm_remove_file_fd_question

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-35951 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).

Nuclei Templates (1)

Wordpress Quiz and Survey Master <7.0.1 - Arbitrary File Deletion
CRITICALby princechaddha

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/10348

Scores

CVSS v3 9.9
EPSS 0.7633
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Details

CWE
CWE-306
Status published
Products (1)
expresstech/quiz_and_survey_master < 7.0.1
Published Jan 01, 2021
Tracked Since Feb 18, 2026