CVE-2025-10493

MEDIUM

Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-10493 has a selected CVSS score of 5.3 (medium); EIP currently links 1 catalogued exploit.

Description

The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by manipulating the chained_completion_id cookie value, allowing them to alter quiz answers, scores, and results of any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 18, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Chained Quiz

Browse prasunsen / Chained Quiz

Default status: unaffected

CVE ListThrough 1.3.5affected

Proofs of concept

1

Catalogued exploits

ExploitDBChained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via CookieExploitDB exploitby 0xsabreWriteup1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing an Insecure Direct Object Reference (IDOR) vulnerability in the Chained Quiz WordPress plugin. It explains how the plugin uses a predictable completion ID in a cookie to identify quiz attempts and how an attacker can manipulate this cookie to modify other users' quiz answers and scores. The writeup includes a step-by-step description of the attack flow and example HTTP requests, but it does not contain any executable exploit code or an automated scanner.

Backdoor review

No backdoor observed in reviewed code

The supplied text is a standard vulnerability disclosure and proof-of-concept (PoC) document for CVE-2025-10493. It describes an Insecure Direct Object Reference (IDOR) vulnerability in the Chained Quiz WordPress plugin and provides a step-by-step PoC demonstrating how an attacker can manipulate a cookie to modify another user's quiz answers. The document contains no executable code, no concealed payloads, no instructions for the reviewer to perform any action, and no evidence of any behavior beyond the described exploit against the stated target.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesEnglish
Target softwareChained Quiz (WordPress plugin)
Attack typesInsecure Direct Object Reference (IDOR)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a textual description of a vulnerability, including its mechanism, impact, and a manual step-by-step proof-of-concept narrative. It contains no executable code, no automated scanning logic, and no script that could be run to exploit or detect the vulnerability. It is a substantive technical analysis, fitting the definition of a writeup.

exploits/multiple/webapps/52464.txt:1-105

Requirements

  • The attacker must be able to intercept or craft HTTP requests to the target WordPress site's admin-ajax.php endpoint.exploits/multiple/webapps/52464.txt:57-59
  • The attacker must know or be able to guess a valid completion_id value belonging to another user's quiz attempt.exploits/multiple/webapps/52464.txt:73-76

Observed behavior

  • The writeup describes how an attacker can modify the chained_completion_id cookie in a quiz submission request to point to another user's quiz attempt.exploits/multiple/webapps/52464.txt:73-76
  • The writeup explains that the server updates the quiz attempt record based on the cookie value without verifying ownership, allowing the attacker to overwrite another user's answers and scores.exploits/multiple/webapps/52464.txt:24-27exploits/multiple/webapps/52464.txt:85-87
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
Payload withheldThis is the stated purpose of the PoC and aligns with the CVE description. It does not constitute a backdoor or deceptive payload.exploits/multiple/webapps/52464.txt:17-37
Proof Of Concept
Payload withheldThis is a standard PoC for the described IDOR vulnerability. It does not instruct the user to download or execute any external payload, nor does it contain any hidden or obfuscated code.exploits/multiple/webapps/52464.txt:46-88
Review boundaries

What the analysis did not establish

  • The evidence consists of a single text file; no executable code or scanner script is present.
  • The analysis is based solely on the supplied text; the described behavior was not verified by executing any code.
  • The review is limited to the supplied text file. No external links, referenced software, or network resources were inspected.
  • The artifact is a text document; no binary or executable content was present to analyze.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

7