Description
The Chained Quiz plugin for WordPress is vulnerable to Insecure Direct Object Reference in version 1.3.4 and below via the quiz submission and completion mechanisms due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to hijack and modify other users' quiz attempts by manipulating the chained_completion_id cookie value, allowing them to alter quiz answers, scores, and results of any user. The vulnerability was partially patched in versions 1.3.4 and 1.3.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| prasunsen | Chained Quiz | ≤ 1.3.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie EDB-52464 · webapps · Dec 25, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1d8f6965-1fe3-4f24-bd6b-9026e91bc5db?source=cve
- https://plugins.trac.wordpress.org/browser/chained-quiz/tags/1.3.3/controllers/quizzes.php
- https://plugins.trac.wordpress.org/browser/chained-quiz/tags/1.3.3/models/quiz.php
- https://plugins.trac.wordpress.org/changeset/3362561/
- https://plugins.trac.wordpress.org/changeset/3362701/
- https://plugins.trac.wordpress.org/changeset/3362966/