Quiz Cat CVE-2026-94082

Requires an authenticated WordPress account with at least the Author role (matching PR:H) on a site running the Quiz Cat plugin version 3.1.1 or earlier; the attacker sends a crafted request to the plugin's vulnerable endpoint over the network (AV:N/AC:L) with no additional user interaction. Exploitation is limited by the need for pre-existing Author privileges - anonymous visitors and Subscriber/Contributor-only accounts cannot trigger it - making sites that grant Author roles to untrusted or many users (multi-author, membership, or user-generated-content sites) the realistic exposure surface. The specific injectable parameter is not disclosed in the available data.

This is a real but bounded risk. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L, score 7.6) describes a network-reachable, low-complexity SQL injection that requires high privileges (PR:H) - consistent with the vulnerability name 'Author SQL Injection,' meaning an authenticated user holding at least the WordPress Author role. This authentication barrier is the single most important limiting factor: exploitation is not available to anonymous internet users, only to accounts already trusted with content-authoring capabilities, which sharply narrows the realistic attacker population to insiders, compromised author accounts, or sites that hand out Author roles broadly (e.g. multi-author blogs or membership sites). No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the high base score is driven by the C:H confidentiality impact and the vendor-assigned scope change (S:C), not by ease of access. I would characterize this as a moderate-priority patch item rather than an emergency: genuine (full database read via CWE-89) but gated behind meaningful privileges on a niche plugin with no exploitation signal. Note one point to verify: Patchstack assigned S:C and A:L, which is somewhat generous for an in-database SQLi - most authenticated plugin SQLi are scored S:U, so the 7.6 may be slightly inflated relative to real-world impact.

An attacker who already holds (or has phished/compromised) a WordPress Author-level account on a site running Quiz Cat ≤ 3.1.1 submits a crafted request to the vulnerable plugin endpoint, injecting SQL into an unsanitized parameter. Because the query executes against the WordPress database, the attacker extracts sensitive data such as user records and password hashes, enabling account takeover or privilege escalation. No public PoC is available, and exploitation requires authenticated Author privileges plus a reachable plugin request path.