CVE-2020-35951 Explained : Impact and Mitigation

An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress, allowing users to delete arbitrary files and potentially take a site offline.

Understanding CVE-2020-35951

This CVE involves a critical vulnerability in the Quiz and Survey Master plugin for WordPress that could lead to severe consequences if exploited.

What is CVE-2020-35951?

The vulnerability in the Quiz and Survey Master plugin allows users to delete arbitrary files, including essential files like wp-config.php, which can render a site inoperable and enable an attacker to reinstall a WordPress instance under their control.

The Impact of CVE-2020-35951

The impact of this vulnerability is rated as critical with a CVSS base score of 9.9, indicating a severe threat to affected systems. The availability impact is high, potentially leading to service disruption.

Technical Details of CVE-2020-35951

This section delves into the technical aspects of the CVE to provide a deeper understanding of the issue.

Vulnerability Description

The vulnerability allows unauthenticated users to delete arbitrary files, leading to a site takedown and potential compromise by malicious actors.

Affected Systems and Versions

Product: Quiz and Survey Master plugin
Vendor: N/A
Versions affected: Before 7.0.1

Exploitation Mechanism

The issue arises from the qsm_remove_file_fd_question function, which permits unauthorized deletions, contrary to its intended use.

Mitigation and Prevention

It is crucial to take immediate action to mitigate the risks posed by CVE-2020-35951.

Immediate Steps to Take

Update the Quiz and Survey Master plugin to version 7.0.1 or later to patch the vulnerability.
Monitor for any unauthorized file deletions or suspicious activities on the website.

Long-Term Security Practices

Regularly update all plugins and themes to prevent known vulnerabilities from being exploited.
Implement strong access controls and user permissions to limit unauthorized actions.

Patching and Updates

Stay informed about security updates for all installed plugins and promptly apply patches to address known vulnerabilities.