{“lastseen”:”2026-01-07T21:45:35″,”description”:”WordPress Chained Quiz plugin versions 1.3.5 and below appear to suffer from an insecure direct object reference. The issue was partially patched in versions 1.3.4 and 1.3.5…”,”published”:”2026-01-07T00:00:00″,”modified”:”2026-01-07T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress Chained Quiz 1.3.5 Insecure Direct Object Reference”,”source”:””,”references”:””,”id”:”PACKETSTORM:213575″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-10493″],”sourceData”:”# Exploit Title: Chained Quiz 1.3.5 – Unauthenticated Insecure Direct Object Reference via Cookie\\n # Date: 19-12-2025\\n # Exploit Author: Karuppiah Sabari Kumar(0xsabre)\\n # Vendor Homepage: https:\/\/wordpress.org\/plugins\/chained-quiz\/\\n # Software Link: https:\/\/downloads.wordpress.org\/plugin\/chained-quiz.1.3.3.zip\\n # Version: \\u003c= 1.3.3\\n # Tested on: WordPress \/ Linux\\n # CVE: CVE-2025-10493\\n \\n ————————————————————\\n \\n ## Vulnerability Type\\n Insecure Direct Object Reference (IDOR) \/ Improper Authorization\\n \\n ————————————————————\\n \\n ## Description\\n The Chained Quiz plugin stores each quiz attempt using a predictable,\\n auto-incrementing database ID (completion_id) and exposes this value\\n directly in a client-side cookie named:\\n \\n chained_completion_id\\u003cquiz_id\\u003e\\n \\n When submitting or re-submitting quiz answers via admin-ajax.php, the\\n server updates the quiz attempt record based solely on this cookie value,\\n without verifying that the attempt belongs to the currently authenticated\\n user.\\n \\n No authentication is required to exploit this vulnerability when the\\n plugin is used with default settings.\\n \\n The server retrieves the quiz attempt directly using the completion_id\\n from the cookie and performs an UPDATE query without verifying ownership.\\n \\n As a result, an attacker can hijack or tamper with other users\u2019 quiz\\n attempts by guessing or enumerating valid completion_id values and\\n replaying answer submissions.\\n \\n ————————————————————\\n \\n ## Affected Component\\n Quiz submission and results handling functionality via admin-ajax.php\\n \\n ————————————————————\\n \\n ## Proof of Concept (PoC)\\n \\n ### Step 1: Victim user submission\\n A user completes a quiz. The submission is stored using a completion ID\\n and associated with the user\u2019s session via a cookie, for example:\\n \\n chained_completion_id1=2\\n \\n ————————————————————\\n \\n ### Step 2: Attacker interception\\n The attacker completes the same quiz and intercepts their own submission\\n request using a proxy or browser developer tools.\\n \\n Example request:\\n \\n POST \/wp-admin\/admin-ajax.php HTTP\/1.1\\n Host: localhost\\n Cookie: chained_completion_id1=1\\n Connection: keep-alive\\n Content-Type: application\/x-www-form-urlencoded\\n \\n answer=0\\u0026question_id=1\\u0026quiz_id=1\\u0026post_id=117\\u0026question_type=radio\\u0026points=0\\u0026action=chainedquiz_ajax\\u0026chainedquiz_action=answer\\u0026total_questions=1\\n \\n ————————————————————\\n \\n ### Step 3: Tampering\\n The attacker modifies the cookie value to match another user\u2019s quiz\\n attempt, for example:\\n \\n chained_completion_id1=2\\n \\n The attacker may also modify parameters such as \\”answer\\” or \\”points\\” to\\n manipulate quiz responses or scores.\\n \\n The modified request is then sent to the server.\\n \\n ————————————————————\\n \\n ### Step 4: Result\\n The server overwrites the victim user\u2019s quiz submission, including answers\\n and points, without validating ownership of the completion ID.\\n \\n ————————————————————\\n \\n ## Impact\\n An attacker can arbitrarily modify quiz answers, scores, or results\\n belonging to other users. This results in an integrity violation of quiz\\n data and allows unauthorized manipulation of finalized quiz attempts.\\n In environments where quiz results are used for assessments, leaderboards,\\n or certificates, this can undermine trust in the platform and affect any\\n downstream integrations that rely on quiz completion data.\\n \\n ————————————————————\\n \\n ## CWE\\n – CWE-639: Authorization Bypass Through User-Controlled Key\\n – CWE-285: Improper Authorization\\n \\n ————————————————————“,”sourceHref”:”https:\/\/packetstorm.news\/download\/213575″,”cvss”:{“score”:5.3,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:N\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/213575\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-07T21:45:35″,”description”:”WordPress Chained Quiz plugin versions 1.3.5 and below appear to suffer from an insecure direct object reference. The issue was partially patched in versions 1.3.4…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,22,12,21,13,53,7,11,5],"class_list":["post-34541","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-53","tag-exploit","tag-medium","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n