CVE-2020-35951

Katalog CVE

CVSS 9.9 · Critical EPSS 76,3%

Kerentanan Missing Authentication for Critical Function pada expresstech quiz and survey master. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).

Rincian

Terbit di NVD

1 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

76,3% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/10348 exploit · advisory pihak ketiga
• https://www.wordfence.com/blog/2020/08/critical-vulnerabilities-patched-in-quiz-and-survey-master-plugin/ exploit · advisory pihak ketiga