PT-2026-5966 · Expresstech Systems · Quiz/Survey Master

Published 2026-02-03 · Updated 2026-02-22 · CVE-2025-67987

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions ExpressTech Systems Quiz And Survey Master versions through 10.3.1

Description A flaw exists in ExpressTech Systems Quiz And Survey Master that allows for SQL Injection. The issue impacts approximately 40,000 WordPress sites globally. A low-privilege, logged-in user can exploit this to query or modify the WordPress database, potentially exposing or altering site data. The issue is due to improper neutralization of special elements used in an SQL command. Exploitation may involve requests to plugin endpoints and unexpected database activity.

Recommendations Update to version 10.3.2 or later. Review logs for suspicious requests to plugin endpoints. Review logs for unexpected database activity.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67987

Affected Products

Quiz/Survey Master

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-67987 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/quiz-master-next/vulnerability/wordpress-quiz-and-survey-master-plugin-10-3-1-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/ThreatSynop/status/2018730524584358236 · Twitter Post
• https://twitter.com/CVEnew/status/2025524059790795002 · Twitter Post