CVE-2022-4220
MEDIUMChained Quiz <= 1.3.2.4 - Cross-Site Request Forgery via list_questions() Function
Title source: llmDescription
The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to delete questions from quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
References (5)
Core 5
Core References
Exploit, Third Party Advisory
https://gist.github.com/Xib3rR4dAr/417a11bcb9b8da28cfe5ba1c17c44d0e
Patch, Third Party Advisory
https://plugins.trac.wordpress.org/browser/chained-quiz/trunk/controllers/questions.php#L73
Patch, Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2826623%40chained-quiz&new=2826623%40chained-quiz&sfp_email=&sfph_mail=
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-4220
Scores
CVSS v3
5.4
EPSS
0.0040
EPSS Percentile
31.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-352
Status
published
Products (2)
kibokolabs/chained_quiz
< 1.3.2.4
prasunsen/Chained Quiz
< 1.3.2.4
Published
Dec 02, 2022
Tracked Since
Feb 18, 2026