CVE-2023-0291

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jun 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-02928.1The Quiz And Survey Master plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.0.8. This is CVE-2023-02934.3The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its A CVE-2023-02944.3The Mediamatic – Media Library Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.CVE-2023-02954.8The Launchpad plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several of its settings parameters in versions up to, an CVE-2023-02965.3The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy comp CVE-2023-02979.8Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.CVE-2023-02986.5Incorrect Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.CVE-2023-02999.8Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.CVE-2023-03005.4Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301.CVE-2023-03015.4Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.CVE-2023-03027.8Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.CVE-2023-03037.5A vulnerability was found in SourceCodester Online Food Ordering System. It has been rated as critical. Affected by this issue is some unkno