Quiz Maker CVE-2025-10042

Exploitable ONLY when BOTH conditions hold: (1) the server/plugin is configured to obtain the client IP from a user-supplied field such as the X-Forwarded-For header rather than the real connection address, and (2) the plugin's 'limit users by IP' feature is enabled. The injection point is the IP value carried in that header, concatenated into an insufficiently escaped and unprepared SQL query. Limiting factors: this is NOT the default configuration, so sites not behind a trusted reverse proxy with IP limiting enabled are not affected; impact is confidentiality-only (data read), with no integrity or availability impact and no authentication required when the preconditions are met. Affected: all Quiz Maker (Ays Pro) versions up to and including 6.7.0.56; fixed in 6.7.0.57.

Signals conflict and net out to lower-than-headline risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) scores 7.5 and portrays an unauthenticated, network, low-complexity confidentiality breach - but the description explicitly gates exploitation on a non-default deployment: the server must be configured to read the client IP from a user-supplied header such as X-Forwarded-For AND the plugin's 'limit users by IP' feature must be enabled. That configuration dependency is not reflected in the AC:L rating; a more honest attack complexity is High, which would materially lower the real score. EPSS reinforces the de-prioritization: 0.04% (12th percentile) indicates essentially no observed exploitation activity, and the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. A public exploit does exist (Exploit-DB 52465), so capability is available even if adoption is not. SSVC-style read: exploitation = PoC (public code, not active); automatable = unlikely given the configuration precondition; technical impact = partial (confidentiality-only read of database contents, no write or availability loss). Net: this is a credible but conditional SQL injection in a WordPress plugin, not a drop-everything priority - treat it as an important routine patch, prioritized higher for sites known to run behind a proxy with IP-based limiting enabled.

A site runs Quiz Maker (<= 6.7.0.56) configured to derive the visitor IP from the X-Forwarded-For header with the 'limit users by IP' option enabled. An unauthenticated attacker sends a quiz-related request with a crafted X-Forwarded-For value containing SQL syntax, which is concatenated into an unprepared query, allowing extraction of sensitive database data such as user credentials or secrets. Public exploit code (Exploit-DB 52465) is available, lowering the skill barrier.