WpCues Basic Quiz CVE-2026-89214

Exploitation requires that the WpCues Basic Quiz plugin (version 1.6.5 or earlier) is installed and active on a reachable WordPress site; the injection occurs through a plugin-handled request parameter that is unsafely used in a SQL query. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, privileges, user interaction, or non-default configuration is needed - exploitation works against a default install of the vulnerable plugin. The only practical limiting factor is the plugin's presence and active status; sites without it, or those upgraded past 1.6.5 (if a fix exists), are not exposed. Impact is limited to unauthorised data disclosure, not data modification or denial of service.

Multiple signals point to a genuine, actionable priority rather than a paper-tiger high-CVSS issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, 8.6) describes a fully remote, unauthenticated, low-complexity attack with no user interaction - the easiest possible access profile - and a publicly available exploit (via WPScan) lowers the skill barrier further. The impact is confidentiality-only (C:H, I:N, A:N), consistent with a data-read SQL injection that cannot directly modify or destroy data. No EPSS probability and no CISA KEV status were supplied in the input, so there is NO evidence of mass or confirmed active exploitation at this time; the presence of public PoC code indicates capability, not observed in-the-wild activity - these are distinct signals and should not be conflated. The dominant mitigating factor is deployment footprint: this is an obscure, single-purpose WordPress quiz plugin, so even with trivial exploitability the realistic blast radius is limited to the relatively few sites running it. Note also a methodology caveat: the input assigns S:C (scope changed), which inflates the base score; for a read-only SQLi confined to the application's own database, S:U is equally defensible - verify scope interpretation before treating 8.6 as directly comparable to other 8.6 ratings.

An unauthenticated attacker locates a WordPress site running the WpCues Basic Quiz plugin (version 1.6.5 or earlier) and sends a crafted HTTP request to a vulnerable quiz parameter that is concatenated into a SQL statement without sanitisation. Because public exploit code exists (WPScan), the attacker can automate injection to dump sensitive database contents such as user records, password hashes, and session or secret values. No authentication, privileges, or user interaction are required, making opportunistic internet-wide scanning feasible.