The Quiz and Survey Master plugin for WordPress is a widely used tool for creating interactive quizzes, surveys, and exams. It offers customizable themes, multiple question formats, and detailed reporting features, making it popular among educators, marketers, and website owners. The plugin is designed to enhance user engagement and collect valuable data through interactive content.
CVE-2020-35951 is a critical arbitrary file deletion vulnerability that arises from insufficient authorization checks in the plugin's file handling functionality. The vulnerability allows an attacker to delete arbitrary files on the server without authentication, exploiting a lack of proper validation in the file deletion process.
The vulnerable endpoint is the qsm_remove_file_fd_question function, which is intended to allow users to delete their own quiz-answer files. However, due to missing capability checks, any unauthenticated user can call this function and specify any file path, leading to deletion of critical system files like wp-config.php.
If exploited, an attacker can delete essential WordPress configuration files, causing the site to become inaccessible or allowing them to install a malicious WordPress instance. This can lead to complete site takeover, data theft, ransomware attacks, and severe reputational and financial damage.
- Update the Quiz and Survey Master plugin to version 7.0.1 or later immediately.
- Implement a web application firewall (WAF) to block malicious requests targeting the qsm_remove_file_fd_question function.
- Restrict file permissions on critical files like wp-config.php to read-only for the web server user.
- Regularly backup all website data and store backups offsite.
- Use strong passwords and enable two-factor authentication for all admin accounts.
- Monitor server logs for unusual file deletion attempts or unauthorized access.
- Conduct regular vulnerability scans using tools like S4E to detect similar issues.
- Disable unused plugins and features to reduce attack surface.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →