What is the CVSS score of CVE-2026-65454?

CVE-2026-65454 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Quiz And Survey Master are affected by CVE-2026-65454?

The Quiz And Survey Master WordPress plugin versions 11.2.0 and earlier contain an SQL injection vulnerability (CVE-2026-65454, CVSS 8.5) that allows low-privileged WordPress users to extract…

How to fix or mitigate CVE-2026-65454?

Within 24 hours: Identify all WordPress installations running Quiz And Survey Master version 11.2.0 or earlier and document which sites are actively using the plugin; disable or deactivate the plugin immediately if not critical to business operations. Within 7 days: Audit WordPress user accounts with Contributor or higher privileges, restrict unnecessary low-privilege account creation, and implement database query logging to detect suspicious SQL patterns; review access controls for existing Contributor accounts and remove unnecessary permissions. Within 30 days: Monitor the plugin's official repository for a released security patch and prepare for an immediate upgrade upon release; if no patch timeline is available, evaluate and migrate to an actively maintained alternative quiz or survey solution to eliminate long-term exposure.

Quiz And Survey Master CVE-2026-65454

EUVD-2026-48219 HIGH

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-vhfh-p7xf-hf2j

WordPress SQLi Quiz And Survey Master Wordpress Plugin

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.5 HIGH

Contributor authentication gives PR:L; network-reachable low-complexity SQLi with no interaction; scope change and C:H reflect full-database read beyond the plugin, with limited integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:37 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 8.5

DescriptionCVE.org

Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.

AnalysisAI

Authenticated SQL injection in the Quiz And Survey Master WordPress plugin (versions 11.2.0 and earlier) lets a low-privileged Contributor-level user inject arbitrary SQL through the plugin's quiz/survey handling, exposing the entire WordPress database. The CVSS 3.1 base score is 8.5 with a scope change, reflecting that a single low-trust account can read data across the whole database rather than just plugin-scoped tables. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is Quiz And Survey Master (quiz-master-next), a WordPress plugin by ExpressTech Systems used to build quizzes and surveys. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input reaches a database query without adequate parameterization or escaping - a classic failure to use WordPress's $wpdb->prepare(). Because the exploitation path is reachable by a Contributor role, the plugin exposes a query-building code path to users who should only be able to author draft content, and the scope-changed CVSS vector indicates the injection reaches the shared WordPress database beyond the plugin's own security authority.

RemediationAI

Upgrade Quiz And Survey Master to the first release above 11.2.0 as published by the vendor; the input data does not include an exact fixed version, so confirm the patched release number against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-11-2-0-sql-injection-vulnerability) and the plugin's changelog on the WordPress.org repository before deploying. Until patched, restrict who holds the Contributor role and audit existing Contributor accounts, since the attack requires that privilege level - removing or downgrading untrusted Contributor accounts directly eliminates the attack surface at the cost of limiting community authoring. As a compensating control, place a WAF (e.g. Patchstack or equivalent) in front of the site with SQLi rules covering the plugin's request parameters, and monitor database query logs for anomalous statements originating from Contributor sessions; WAF virtual patching may cause false positives on legitimate quiz submissions and should be tested.