{"id":"CVE-2020-35951","aliases":["EUVD-2020-23534","GHSA-r275-5g72-r3ph"],"status":"published","title":"An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It...","description":"An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:N/S:C/UI:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.76328,"percentile":0.99541,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306","CWE-863"],"published":"2021-01-01T03:27:03Z","modified":"2026-06-17T03:14:40Z","exploits":[{"source":"nuclei","id":"CVE-2020-35951","title":"Wordpress Quiz and Survey Master \u003c7.0.1 - Arbitrary File Deletion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-35951.yaml"}],"products":[{"vendor":"expresstech","product":"quiz_and_survey_master"}],"references":[{"url":"https://www.wordfence.com/blog/2020/08/critical-vulnerabilities-patched-in-quiz-and-survey-master-plugin/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://wpscan.com/vulnerability/10348","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-35951"},{"url":"https://github.com/advisories/GHSA-r275-5g72-r3ph"}],"sources":{"cve":[{"id":"CVE-2020-35951","description":"An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).","status":"published","published":"2021-01-01T03:27:03Z","modified":"2024-08-04T17:16:13.461Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:N/S:C/UI:N","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:35:57.975444Z"}],"euvd":[{"id":"EUVD-2020-23534","description":"An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).","status":"published","published":"2021-01-01T03:27:03Z","modified":"2024-08-04T17:16:13Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AC:L/AV:N/A:H/C:L/I:L/PR:N/S:C/UI:N","level":"critical"}],"updated_at":"2026-11-03T03:07:04.595509Z"}],"ghsa":[{"id":"GHSA-r275-5g72-r3ph","title":"An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It...","description":"An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).","status":"published","published":"2022-05-24T17:37:51Z","modified":"2023-01-29T05:04:54Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:45:40.253766Z"}],"nvd":[{"id":"CVE-2020-35951","description":"An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files).","status":"published","published":"2021-01-01T04:15:13.667Z","modified":"2026-06-17T03:14:40.17Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:06:28.340168Z"}]}}