PT-2026-27249 · WordPress · Quiz/Survey Master

Thanh Hao · Publicado 2026-03-23 · Atualizado 2026-03-23 · CVE-2026-2412

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master (QSM) plugin for WordPress versions through 10.3.5

Description The Quiz and Survey Master (QSM) plugin for WordPress is susceptible to SQL Injection through the merged question parameter. Insufficient input sanitization allows malicious code to be injected into SQL queries. The sanitize text field() function does not prevent SQL metacharacters such as ), OR, AND, and # from being included in the value of the merged question parameter. This value is then directly concatenated into a SQL IN() clause without proper preparation, enabling authenticated attackers with Contributor-level access or higher to append additional SQL queries to extract sensitive information from the database.

Recommendations Versions prior to and including 10.3.5 should be updated to a newer, fixed version when available. As a temporary workaround, restrict access to the merged question parameter to prevent exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-2412

Produtos afetados

Quiz/Survey Master

Referências · 6

• https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/classes/class-qsm-questions.php · Nota
• https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/rest-api.php · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2412 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/rest-api.php#L760 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/b32bf1cb-3722-41fc-be51-dabe80416b14?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-questions.php#L387 · Nota