CVE-2022-4220: 
WordPress vulnerability analysis and mitigation

The Chained Quiz plugin for WordPress was found to contain a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 1.3.2.4. The vulnerability was discovered and disclosed on December 2, 2022 (NVD).

The vulnerability has been assigned a CVSS Score of 5.4 (Medium) with the CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. The vulnerability affects multiple endpoints in the plugin, including quiz deletion, response management, and question management functionalities (Wordfence).

The vulnerability could allow attackers to perform unauthorized actions on behalf of authenticated users, including deleting quizzes, submitted responses, and questions from quizzes. These actions could lead to data loss and disruption of quiz functionality (GitHub Gist).

The vulnerability can be exploited through crafted URLs that perform actions such as deleting quizzes (/wp-admin/admin.php?page=chained_quizzes&del=1&id=2), deleting submitted responses, and removing questions from quizzes. The exploitation requires user interaction but does not require authentication (GitHub Gist).

Users are advised to update their Chained Quiz plugin to a version newer than 1.3.2.4 to address this vulnerability (NVD).