What is the CVSS score of CVE-2026-6448?

CVE-2026-6448 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Quiz and Survey Master CVE-2026-6448

EUVD-2026-34930 MEDIUM

SQL Injection (CWE-89)

2026-06-06 security@wordfence.com

GHSA-xpvq-q3qp-wcjj

SQLi WordPress

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 06, 2026 - 00:29 vuln.today

CVE Published

Jun 06, 2026 - 00:16 nvd

MEDIUM 4.9

DescriptionCVE.org

The Quiz and Survey Master (QSM) - Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' parameter in all versions up to, and including, 11.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. If the secret key is exposed, this can be exploited by lower-privileged users.

AnalysisAI

Time-based blind SQL injection in the Quiz and Survey Master (QSM) WordPress plugin versions through 11.1.2 allows authenticated administrators to extract sensitive database contents via the unsanitized 'order' parameter in the quiz API. The vulnerability resides in class-qsm-quiz-api.php at multiple query construction points (lines 126, 131, 164, 243, 374), where user-supplied sort order values are concatenated directly into SQL without prepared statements. Critically, if the plugin's secret key is exposed, this privilege barrier drops, enabling lower-privileged users to exploit the same injection path. No public exploit code or CISA KEV listing is identified at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-89 (Improper Neutralization of Special Elements used in SQL Command), a classic SQL injection class caused by insufficient input escaping and the absence of parameterized queries. The affected code is in the plugin's REST API class (class-qsm-quiz-api.php), where the 'order' parameter - typically used for sorting quiz result listings - is incorporated directly into SQL query strings without adequate preparation. Time-based blind injection implies the attacker infers data values through conditional time delays (e.g., using SLEEP() or BENCHMARK() in MySQL), exfiltrating database contents character by character without direct output reflection. The plugin runs on WordPress, which uses MySQL/MariaDB as its database backend. Affected CPE is consistent with the WordPress plugin ecosystem: the vulnerable codebase is confirmed present in tag 10.3.5 per NVD references, and the trunk changeset 3547016 represents the upstream remediation point.

RemediationAI

The primary fix is to update the Quiz and Survey Master plugin beyond version 11.1.2 once a patched release incorporating changeset 3547016 is published to the WordPress plugin repository (https://plugins.trac.wordpress.org/changeset?old=3547016%40quiz-master-next&new=3547016%40quiz-master-next). Monitor the Wordfence threat intel advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d230b781-e208-4e66-b8ed-aba72db8d8dc for confirmed patched version details. As an interim compensating control, restrict WordPress admin account access to trusted IP ranges via server-level firewall or a WordPress security plugin such as Wordfence, reducing the exposure window for the high-privilege requirement. Additionally, audit and rotate the QSM plugin's secret key immediately if there is any possibility it has been exposed, since key exposure lowers the effective privilege bar for exploitation. Note: IP restriction may break legitimate remote admin workflows and should be coordinated with site administrators before deployment. The patched version number is not independently confirmed from available input data - verify against the plugin changelog before deploying.