Description

The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randon_category' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T05:16:47.407Z",
  "pubdate": "2026-08-16T05:16:47.407Z",
  "executiveSummary": "The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is affected by a generic SQL Injection vulnerability in all versions up to, and including, 11.2.1. This security flaw arises due to insufficient escaping of user-supplied input and a lack of proper parameterization within existing SQL queries.\nAn authenticated attacker with custom-level access and above can exploit this vulnerability to append arbitrary SQL queries to pre-existing database operations. Successful exploitation enables unauthorized actors to extract sensitive information stored within the underlying database, compromising the confidentiality and integrity of the affected WordPress installation.\nThe vulnerability requires specific authentication and privilege levels, limiting unauthenticated exploitation while still posing a significant risk through privilege escalation or compromised administrative accounts. Mitigation requires updating the affected plugin once a patch is made available by the vendor or implementing strict input validation and query preparation mechanisms.",
  "technicalDetails": "The root cause of the vulnerability resides in the handling of the 'randon_category' Quiz Option within the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin. The application fails to adequately sanitize and escape user-supplied parameter data before incorporating it into database queries. Furthermore, the existing SQL queries lack sufficient preparation, allowing malicious input to alter the intended query logic.\nThe vulnerable component is the query generation and execution logic associated with the 'randon_category' parameter across all versions up to, and including, 11.2.1. The attack vector is accessible over the network via standard HTTP requests handled by the WordPress application.\nExploitation prerequisites require the attacker to possess authenticated access with custom-level privileges or higher. While network exposure is present via the web application interface, the privilege requirement acts as a partial barrier against completely unauthenticated adversaries.\nThe attack flow proceeds as follows: 1) The authenticated attacker interacts with the quiz configuration or submission interface where the 'randon_category' parameter is processed. 2) The attacker submits a specially crafted payload containing malicious SQL syntax designed to break out of the intended query context. 3) Because the input lacks proper escaping and the SQL statement is not prepared using parameterized queries, the database engine interprets the malicious input as executable SQL code. 4) The injected SQL commands are appended to the original query, altering the database execution flow.\nPost-exploitation impact includes the capability to execute unauthorized database queries, leading to the extraction of sensitive information such as user credentials, configuration data, and application records stored in the database."
}