WordPress Quiz Maker Plugin Vulnerable to SQL Injection (CVE Pending)

Critical SQL Injection Vulnerability Discovered in WordPress Quiz Maker Plugin

Security researchers have identified a severe SQL injection (SQLi) vulnerability in WordPress Quiz Maker plugin version 6.7.0.56, which could allow attackers to execute arbitrary database queries on affected websites. The flaw was publicly disclosed via Exploit Database but has not yet been assigned a CVE identifier.

Technical Details

The vulnerability stems from insufficient input validation in the plugin’s code, enabling unauthenticated attackers to inject malicious SQL commands via crafted HTTP requests. While specific exploitation vectors remain undisclosed pending patch availability, SQLi flaws typically allow:

• Unauthorized database access
• Data exfiltration (user credentials, PII)
• Administrative account creation
• Complete site compromise

The affected version (6.7.0.56) is currently in use across thousands of WordPress installations, according to plugin repository metrics.

Impact Analysis

Successful exploitation could lead to:

• Full database compromise, including sensitive user data
• Site defacement or malicious content injection
• Secondary attacks via compromised credentials (e.g., brute-force campaigns)
• Compliance violations for sites handling regulated data (GDPR, PCI DSS)

Recommendations

1. Immediate Actions:

   • Verify plugin version and disable if running 6.7.0.56
   • Monitor database logs for suspicious queries (e.g., UNION-based patterns)
   • Restrict access to /wp-admin/ via IP allowlisting

2. Long-Term Mitigations:

   • Await official patch from plugin developers (expected shortly)
   • Implement a web application firewall (WAF) with SQLi rulesets
   • Conduct a security audit of all WordPress plugins

3. Detection:

   • Scan for indicators of compromise (IoCs) such as:
     • Unusual database user creation
     • Modified plugin files
     • Unexpected admin accounts

Security teams should prioritize this vulnerability due to its unauthenticated attack vector and potential for high-impact breaches. Follow Exploit-DB for updates on proof-of-concept (PoC) availability and CVE assignment.