CVE-2026-14820Disclosure

LOWCVSS 5.3 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3.

Back to dashboard

1.5/ 10 priority

Sources & remediation

Other references

https://wpscan.com/vulnerability/22af8c73-8147-4205-8285-a35881f2d041/

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-07-06); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

#VØID@0x416192d
Disclosure
الحمدلله تم اعتماد الـ CVE 🎉 CVE-2026-14820 • • الثغرة كانت في Wordpress plugin • تصنيفها Medium • الثغرة تسمح لأي شخص بدون Authentication إنه يجيب جميع المستخدمين الموجودين في الإضافة https://wpscan.com/vulnerability/22af8c73-8147-4205-8285-a35881f2d041/ https://t.co/xB6EkYmISW
Post summary
The post announces CVE‑2026-14820, a Medium‑severity bug in a WordPress plugin that lets attackers enumerate all plugin users without authentication; no exploit code or patch details are supplied.
20101594114.8K
3.7K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds71d
Disclosure
CVE-2026-14820 Unauthenticated Username Enumeration and Password Brute-Force in Quiz and Survey Master WordPress Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-14820
Post summary
The post announces CVE-2026-14820, describing an unauthenticated username enumeration and password brute-force flaw in the Quiz and Survey Master WordPress plugin, but it offers no PoC, exploit, or patch details.
0000092
4.1K followersView on X

Explore more

Back to dashboard