title: Quiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure
description: The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.
problem types: CWE-200 Information Exposure
affected:
{
vendor: Unknown
product: Quiz Maker
versions:
status: affected, versionType: semver, version: 0, lessThan: 6.4.9.5
defaultStatus: unaffected
collectionURL: https://wordpress.org/plugins
}