What is the CVSS score of CVE-2026-2412?

CVE-2026-2412 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2412?

Organizations using all should be aware of notable risk from CVE-2026-2412, a SQL injection vulnerability rated CVSS 6.5. Exploitation could allow attackers to execute code or inject malicious input.

How to fix or mitigate CVE-2026-2412?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

WordPress CVE-2026-2412

EUVD-2026-14608 MEDIUM

SQL Injection (CWE-89)

2026-03-23 Wordfence

GHSA-p9xr-7rv6-w58f

WordPress SQLi

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 22:45 euvd

EUVD-2026-14608

Analysis Generated

Mar 23, 2026 - 22:45 vuln.today

CVE Published

Mar 23, 2026 - 22:25 nvd

MEDIUM 6.5

DescriptionCVE.org

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters like ), OR, AND, and

from being included in the value, which is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

The Quiz and Survey Master (QSM) WordPress plugin versions up to 10.3.5 contains a SQL injection vulnerability in the 'merged_question' parameter that allows authenticated attackers with Contributor-level access or higher to extract sensitive database information. The vulnerability exists because the plugin uses sanitize_text_field() which does not prevent SQL metacharacters from being injected into an SQL IN() clause, and the resulting query is not properly parameterized using $wpdb->prepare() or integer casting. With a CVSS score of 6.5 and network-based attack vector requiring only low privileges, this represents a moderate but real threat to WordPress installations using this plugin.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and affects the Quiz and Survey Master plugin (CPE: cpe:2.3:a:expresstech:quiz_and_survey_master_(qsm)_–_easy_quiz_and_survey_maker). The flaw occurs in two key locations identified in the WordPress plugin repository: the class-qsm-questions.php file at line 387 and the rest-api.php file at line 760. The plugin constructs SQL queries by concatenating user-supplied input from the 'merged_question' parameter directly into SQL IN() clauses without proper escaping or parameterization. While sanitize_text_field() removes HTML tags and some dangerous characters, it does not prevent SQL metacharacters such as closing parentheses, OR, AND, and hash symbols from passing through, enabling attackers to break out of the intended query context and inject arbitrary SQL.

RemediationAI

Sites running Quiz and Survey Master should upgrade immediately to version 10.3.6 or later, which includes patches referenced in WordPress plugin repository changesets 3486710 for both class-qsm-questions.php and rest-api.php that implement proper SQL parameterization using $wpdb->prepare(). Administrators should verify the update through the WordPress plugin dashboard or manually via wp-cli using 'wp plugin update quiz-master-next'. As a temporary mitigation while awaiting patching, restrict REST API access to authenticated users only via .htaccess or a Web Application Firewall, and review user roles to minimize the number of Contributor-level and above accounts that could exploit this vulnerability. Monitor WordPress error logs and database query logs for suspicious IN() clause patterns or authentication anomalies. The official advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b32bf1cb-3722-41fc-be51-dabe80416b14 and the WordPress plugin changelog should be consulted for specific version details and confirmation of patches.