WP Manifestindependent plugin directory
manifest / ai / lumination-quiz-generator

Lumination AI Quiz Generator WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

Lumination AI Quiz Generator — WordPress plugin for generating interactive quizzes from documents, URLs, or text. Requires Lumination Core.

★ 0stars
12release downloads
v1.1.0latest · 3mo ago

Install

Download lumination-quiz-generator.zip From the v1.1.0 release on GitHub, Jul 6, 2026

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/borjablm/lumination-quiz-generator/releases/download/v1.1.0/lumination-quiz-generator.zip
Updates itself. It ships its own updater (Plugin Update Checker), so new versions appear under Dashboard → Updates.

Generate interactive quizzes from PDFs, URLs, or pasted text. Configurable question count and difficulty, instant scoring, and export to CSV.

Description

Lumination AI Quiz Generator creates interactive quizzes from any content source. Paste a URL, upload a PDF, or type text — and get a scored quiz with configurable difficulty and question count.

Requires Lumination Core (free) — install it first.

Features

  • Multiple input modes — URL, text paste, or PDF upload (auto-tabbed interface)
  • Configurable quizzes — set question count (3–30) and difficulty (easy, medium, hard)
  • Timer support — optional countdown timer (5, 10, or 15 minutes)
  • Instant scoring — immediate feedback with explanations per question
  • Hints — optional hints for each question
  • Export — download Q&A or score reports as CSV
  • Retake — retake the same quiz or generate a new one

Shortcode

Place [lumination_quiz_generator] on any page or post.

Getting Started

  1. Install and activate Lumination Core.
  2. Go to Tools → Lumination → API Configuration and enter your API key and base URL.
  3. Install and activate Lumination AI Quiz Generator.
  4. Add [lumination_quiz_generator] to any page.

Installation

  1. Install Lumination Core first and configure your API credentials.
  2. Upload the lumination-quiz-generator folder to /wp-content/plugins/.
  3. Activate the plugin via the Plugins screen.
  4. Add [lumination_quiz_generator] to any page or post.

Frequently Asked Questions

Do I need Lumination Core?

Yes. The quiz generator requires Lumination Core for API access and analytics. If Core is not active, the plugin shows an admin notice and the shortcode outputs nothing.

What file types are supported?

PDF files up to 10 MB.

Where is my usage data?

In Tools → Lumination → Usage Analytics (provided by Lumination Core).

Changelog

1.1.0

  • Migrate to the AI Tutor API v1 /quiz endpoint (requires Lumination Core 1.2.0+).
  • Quiz generation now runs as a single asynchronous job with browser-side polling.

1.0.0

  • Initial release.
  • Shortcode [lumination_quiz_generator].
  • URL, text, and PDF input modes.
  • Configurable question count and difficulty.
  • Timer support with countdown display.
  • Instant scoring with per-question feedback.
  • CSV export for Q&A and score reports.

Upgrade Notice

1.0.0

Initial release.

Releases

3 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.1.0 latest
Jul 6, 2026 3mo ago
lumination-quiz-generator.zip
4
Apr 7, 2026 6mo ago
lumination-quiz-generator.zip
2
Apr 6, 2026 6mo ago
lumination-quiz-generator.zip
6
D+ grade

Security

Lumination AI Quiz Generator 1.1.0 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.1.0
Findings
2
Worst severity
high
Content hash
0944638779fa96281d8dd8e8…

Findings

  • high Unauthenticated SSRF via quiz URL input

    ssrf

    handle_create is registered for wp_ajax_nopriv_lumination_quiz_create. Default access is all visitors (documented; restrict via lumination_core_can_submit). When input_mode=url, extract_from_url() calls wp_remote_get($url) with no scheme/host allowlist, no block of loopback/link-local/RFC1918, and no redirect hardening beyond WP defaults. The shortcode localizes lumination_quiz_nonce for uid 0, so a guest can make the WordPress host fetch attacker URLs and forward extracted text to the vendor API.

    includes/class-quiz-ajax.php:36-37

    Recommendation

    Default can_submit to logged-in users. For URL mode, allowlist public https hosts, deny private/link-local/metadata IPs (including redirect targets), and do not follow redirects to those ranges. Rate-limit more aggressively.

  • high extract_from_url has no destination allowlist

    ssrf

    The SSRF sink is wp_remote_get of attacker-controlled esc_url_raw input. Response body is stripped to text and base64-posted to Lumination. That is enough to read internal HTTP services and cloud metadata if the host can reach them, and to use the site as an open proxy toward the AI backend.

    includes/class-quiz-ajax.php:261-265

    Recommendation

    Validate host against a public-suffix allowlist or block private networks with a custom HTTP transport that re-checks the connected IP after DNS. Do not fetch file://, gopher, or non-http(s) schemes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.