Quiz Maker WordPress Plugin Unauthorized Data Modification Vulnerability

A vulnerability exists in the Quiz Maker WordPress plugin, specifically in the Business, Developer, and Agency versions, all prior to the latest release. The issue stems from a missing capability check in the 'ays_save_google_credentials' function, which allows unauthorized users to modify Google Sheets integration credentials within the plugin's settings. Additionally, the vulnerability could be exploited to inject arbitrary web scripts into pages, executing them when a user accesses the injected page.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of Google Sheets integration credentials and the injection of malicious scripts that could be executed on behalf of the user.

Remediation

Users can update to version 31.8.0.100 for Agency, 8.8.0.100 for Business, or 21.8.0.100 for Developer to address this vulnerability.