CVE-2022-4218
MEDIUMChained Quiz < 1.3.2.4 - Unauthenticated Cross-Site Request Forgery via list_quizzes() Function
Title source: llmDescription
The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. This makes it possible for unauthenticated attackers to delete quizzes and copy quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References (4)
Core 4
Core References
Exploit, Third Party Advisory
https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e
Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4218
Scores
CVSS v3
5.4
EPSS
0.0042
EPSS Percentile
34.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-352
Status
published
Products (2)
kibokolabs/chained_quiz
< 1.3.2.4
prasunsen/Chained Quiz
< 1.3.2.4
Published
Dec 02, 2022
Tracked Since
Feb 18, 2026