CVE-2020-35949

9.8 criticalEPSS 5.1%

Critical (9.8) in expresstech quiz and survey master. EPSS 5.1% chance of exploitation in the next 30 days.

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file, only the Content-Type header was checked during the upload, and thus the attacker could use text/plain for a .php file.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 5.1% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2021-01-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

expresstech:quiz_and_survey_master

References

https://wpscan.com/vulnerability/10349
https://www.wordfence.com/blog/2020/08/critical-vulnerabilities-patched-in-quiz-and-survey-master-plugin/
https://wpscan.com/vulnerability/10349
https://www.wordfence.com/blog/2020/08/critical-vulnerabilities-patched-in-quiz-and-survey-master-plugin/

Check your stack JSON