EUVD-2026-44885
GHSA-4895-w473-xhfc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
UI:R assigned because SQL payload execution requires a second user to view the Questions tab; all other metrics align with the official vector.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsm_ajax_save_pages() AJAX handler (sanitize_text_field only) and lack of sufficient preparation on the existing SQL query built in qsm_options_questions_tab_content() at line 143, where the stored page IDs are interpolated into an IN() clause via implode() with no $wpdb->prepare() and no integer casting. This makes it possible for authenticated attackers, with Author-level access and above (who can own a quiz they are entitled to edit), to plant a SQL payload that is executed second-order whenever any user (including an administrator) views the quiz's Questions tab, allowing them to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
Second-order SQL injection in Quiz Master Next (QSM) for WordPress through version 11.2.0 allows authenticated attackers holding Author-level access to plant SQL payloads in quiz page data that execute whenever any user - including administrators - views the affected quiz's Questions tab. The root cause is a two-stage failure: the qsm_ajax_save_pages() AJAX handler sanitizes user-supplied 'pages' values only with sanitize_text_field() (which strips HTML/PHP tags but does not escape SQL-special characters), then qsm_options_questions_tab_content() at line 143 reconstructs those stored values into an IN() clause via implode() with no $wpdb->prepare() call and no integer casting. No public exploit code has been identified at time of analysis; however, the split-phase attack pattern - where payload planting and execution are decoupled - commonly evades first-order WAF detection and standard code scanning, elevating practical risk beyond the 6.5 CVSS score alone.
Technical ContextAI
The affected product is the Quiz And Survey Master (QSM) WordPress plugin by ExpressTech, identified by CPE cpe:2.3:a:expresstech:quiz_and_survey_master_(qsm)_-_quiz_maker_&_survey_maker:*:*:*:*:*:*:*:*. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements in an SQL Command), specifically in its second-order (stored) variant. In first-order SQLi, the injection and execution occur in the same request; here, the attack spans two separate operations and potentially two separate users. The AJAX handler qsm_ajax_save_pages() at class-qmn-plugin-helper.php line 601 accepts a 'pages' POST parameter, applies only sanitize_text_field() for sanitization, and persists the result to the database. Later, when the Questions tab is rendered, qsm_options_questions_tab_content() at options-page-questions-tab.php line 143 reads those stored page IDs and concatenates them directly into a SQL IN() clause using PHP's implode(), bypassing WordPress's $wpdb->prepare() parameterization entirely and performing no intval() or absint() integer casting. Because sanitize_text_field() does not strip SQL metacharacters such as single quotes, commas, or SQL keywords, an attacker-controlled string like '1 UNION SELECT user_pass FROM wp_users-- ' passes through the save phase unmodified and is embedded verbatim into the query at render time.
RemediationAI
An upstream fix has been committed to the WordPress plugin SVN repository as changeset 3608310, visible at https://plugins.trac.wordpress.org/changeset?reponame=&old=3608310%40quiz-master-next&new=3608310%40quiz-master-next; however, the specific patched release version number is not confirmed in the provided data, so administrators should verify the current version available on WordPress.org and update immediately once a patched release is published. Until a patched version is deployed, the primary compensating control is to restrict Author-level role assignment strictly to fully trusted users, since the attack requires an authenticated Author who owns or can edit a quiz - removing untrusted Authors eliminates the attacker's entry point entirely, with the trade-off that this may restrict legitimate contributors. As an additional defense-in-depth measure, consider deploying the Wordfence WAF or equivalent, configured to inspect AJAX POST bodies for SQL metacharacters in the 'pages' parameter submitted to qsm_ajax_save_pages(); be aware that second-order patterns may evade signature-only WAFs if inspection occurs only at read time. Database administrators should audit existing quiz page records for suspicious SQL fragments (UNION, SELECT, --, #) to detect any payloads already planted prior to patching.
SQL Injection in the Quiz and Survey Master (QSM) WordPress plugin versions up to and including 11.2.1 allows authentica
Stored Cross-Site Scripting in the Quiz and Survey Master (QSM) WordPress plugin through version 11.2.1 allows authentic
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today