CVE-2025-67595: 
WordPress vulnerability analysis and mitigation

CVE-2025-67595 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ays Pro Quiz Maker WordPress plugin. It affects all versions of the plugin through 6.7.0.82 and was published on December 9, 2025, with Patchstack credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium), requiring no privileges but necessitating user interaction to exploit (Feedly, Patchstack).

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate or enforce anti-CSRF tokens on one or more state-changing requests. An unauthenticated remote attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (e.g., an administrator), causes the victim's browser to submit unauthorized requests to the Quiz Maker plugin on their behalf. The attack vector is network-based with low complexity, and exploitation requires the victim to interact with attacker-controlled content (Feedly).

Successful exploitation results in a low-integrity impact, allowing an attacker to perform unauthorized actions within the Quiz Maker plugin on behalf of an authenticated user. This could include modifying quiz configurations, deleting quizzes, or altering plugin settings without the victim's knowledge. There is no direct confidentiality or availability impact, and the scope is limited to the affected plugin's functionality (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67595. The EPSS score is approximately 0.014%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to trick an authenticated WordPress user into visiting a malicious page (Feedly).

1. Reconnaissance: Identify WordPress sites running the Quiz Maker plugin by Ays Pro at version 6.7.0.82 or earlier, using tools like WPScan or passive web fingerprinting.
2. Craft malicious payload: Create an HTML page containing a hidden form or JavaScript that automatically submits a forged request to the target WordPress site's Quiz Maker plugin endpoint (e.g., a quiz deletion or settings modification action).
3. Deliver the payload: Trick an authenticated WordPress administrator or editor into visiting the attacker-controlled page via phishing email, malicious link, or injected content.
4. Trigger the CSRF: The victim's browser automatically sends the forged request with their valid session cookies, causing the Quiz Maker plugin to execute the unauthorized action on the attacker's behalf.
5. Achieve objective: The attacker successfully modifies or deletes quiz data, or alters plugin settings, without the victim's awareness (Feedly).

• Logs: WordPress access logs showing unexpected POST requests to Quiz Maker plugin admin endpoints (e.g., /wp-admin/admin-ajax.php or plugin-specific action URLs) from unusual referrers or external origins.
• Application: Unexplained changes to quiz configurations, quiz deletions, or plugin settings modifications without corresponding administrator activity.
• Network: Requests to Quiz Maker admin endpoints originating from non-administrative IP addresses or with suspicious Referer headers pointing to external domains.

Users should update the Quiz Maker plugin by Ays Pro to version 6.7.0.83 or later, which addresses this CSRF vulnerability. Until an update can be applied, administrators should avoid clicking on untrusted links while logged into WordPress and consider temporarily deactivating the plugin if it is not in active use. Implementing a web application firewall (WAF) with CSRF protection rules can provide an additional layer of defense (Feedly, Patchstack).