CVE-2026-14820

CVE-2026-14820 in the Quiz And Survey Master plugin represents a more serious risk than its CVSS 5.3 rating suggests. The vulnerability isn't username enumeration alone—it's an exploitation chain where username validation enables targeted password attacks, and the entire sequence bypasses the login security controls that protect wp-login.php. The critical mechanism: the QSM front-end endpoint returns distinct server responses for valid versus invalid usernames. An attacker first enumerates valid accounts with minimal effort (each probe reveals whether an account exists), then uses that validated list to mount a targeted brute-force attack against the same endpoint. There is no rate limiting on this credential-checking functionality, and because it lives in the quiz plugin rather than the WordPress login system, standard brute-force protections have no visibility into these requests. What makes this worse than a typical medium-severity finding: the attack surface sits outside the defensive architecture that WordPress sites rely on. Your login security plugin monitors wp-login.php—it never sees these requests to the QSM endpoint. The entire authentication defense ecosystem is blind to this vector. Before assuming you're protected, verify two things: First, confirm whether you're running QSM version 11.1.3 or later—this is the patched release. Second, and more importantly, test the endpoint yourself by submitting credentials with a known-valid username versus a random one. If the responses differ (different error messages, different HTTP status codes, different response times), the enumeration vector persists even with the patch. The patch may have added rate limiting while leaving the distinct response behavior intact—that would still leave the username confirmation channel open. The EPSS score of 0.00224 reflects low 30-day probability, but QSM's install base exceeds 100,000 sites. That's a large target pool, and automated exploitation tools already exist for this vulnerability class (the enumeration-to-brute-force chain has been weaponized across similar plugin patterns since 2023). Prioritize patching on any WordPress site running this plugin.

Reviewed through automated stages and approved by a human before publication.