S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Dec 16, 2023

CVE-2020-35951 Scanner

Targets the qsm_remove_file_fd_question function, allowing unauthenticated attackers to delete arbitrary files including wp-config.php.

Est. Time~15 seconds
Scan TypeSingle Scan
Targetsdomain, ipv4, subdomain
CostFree
2.3k
Times Used
continuous scan runs
4.7k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2020-35951
9.9
CVSScritical
Exploitable remotely over the internet · no authentication required.

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
n/aby n/a
n/a
Updated Aug 21, 2026View on NVD →
Detail

The Quiz and Survey Master plugin for WordPress is a widely used tool for creating interactive quizzes, surveys, and exams. It offers customizable themes, multiple question formats, and detailed reporting features, making it popular among educators, marketers, and website owners. The plugin is designed to enhance user engagement and collect valuable data through interactive content.

CVE-2020-35951 is a critical arbitrary file deletion vulnerability that arises from insufficient authorization checks in the plugin's file handling functionality. The vulnerability allows an attacker to delete arbitrary files on the server without authentication, exploiting a lack of proper validation in the file deletion process.

The vulnerable endpoint is the qsm_remove_file_fd_question function, which is intended to allow users to delete their own quiz-answer files. However, due to missing capability checks, any unauthenticated user can call this function and specify any file path, leading to deletion of critical system files like wp-config.php.

If exploited, an attacker can delete essential WordPress configuration files, causing the site to become inaccessible or allowing them to install a malicious WordPress instance. This can lead to complete site takeover, data theft, ransomware attacks, and severe reputational and financial damage.

Solution Advice
  • Update the Quiz and Survey Master plugin to version 7.0.1 or later immediately.
  • Implement a web application firewall (WAF) to block malicious requests targeting the qsm_remove_file_fd_question function.
  • Restrict file permissions on critical files like wp-config.php to read-only for the web server user.
  • Regularly backup all website data and store backups offsite.
  • Use strong passwords and enable two-factor authentication for all admin accounts.
  • Monitor server logs for unusual file deletion attempts or unauthorized access.
  • Conduct regular vulnerability scans using tools like S4E to detect similar issues.
  • Disable unused plugins and features to reduce attack surface.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.