Quiz Cat
Monthly
Authenticated SQL injection in the Quiz Cat WordPress plugin (versions 3.1.1 and earlier) allows an attacker holding at least the WordPress Author role to send crafted requests that are woven into backend SQL statements, giving read access to sensitive database contents such as user records and stored quiz data, with secondary potential to alter or disrupt data. Exploitation is remote and requires no user interaction, but it is gated behind the Author privilege, so the realistic exposure surface is multi-author, membership, and user-generated-content sites that hand Author accounts to untrusted or numerous users; anonymous visitors and Subscriber- or Contributor-only accounts cannot trigger it. No public exploit code has been identified at time of analysis. The reported CVSS is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), while our independent assessment is slightly more conservative at AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L - both agree the dominant impact is confidentiality loss.
Authenticated SQL injection in the Quiz Cat WordPress plugin (versions 3.1.1 and earlier) allows an attacker holding at least the WordPress Author role to send crafted requests that are woven into backend SQL statements, giving read access to sensitive database contents such as user records and stored quiz data, with secondary potential to alter or disrupt data. Exploitation is remote and requires no user interaction, but it is gated behind the Author privilege, so the realistic exposure surface is multi-author, membership, and user-generated-content sites that hand Author accounts to untrusted or numerous users; anonymous visitors and Subscriber- or Contributor-only accounts cannot trigger it. No public exploit code has been identified at time of analysis. The reported CVSS is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L), while our independent assessment is slightly more conservative at AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L - both agree the dominant impact is confidentiality loss.