PT-2026-27249 · WordPress · Quiz/Survey Master

Thanh Hao · Published 2026-03-23 · Updated 2026-03-23 · CVE-2026-2412

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Quiz and Survey Master (QSM) plugin for WordPress versions through 10.3.5

Description The Quiz and Survey Master (QSM) plugin for WordPress is susceptible to SQL Injection through the merged question parameter. Insufficient input sanitization allows malicious code to be injected into SQL queries. The sanitize text field() function does not prevent SQL metacharacters such as ), OR, AND, and # from being included in the value of the merged question parameter. This value is then directly concatenated into a SQL IN() clause without proper preparation, enabling authenticated attackers with Contributor-level access or higher to append additional SQL queries to extract sensitive information from the database.

Recommendations Versions prior to and including 10.3.5 should be updated to a newer, fixed version when available. As a temporary workaround, restrict access to the merged question parameter to prevent exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-2412

Affected Products

Quiz/Survey Master

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-2412 · Security Note
• https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/classes/class-qsm-questions.php · Note
• https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/rest-api.php · Note
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/rest-api.php#L760 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b32bf1cb-3722-41fc-be51-dabe80416b14?source=cve · Note
• https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-questions.php#L387 · Note