SQL Injection Vulnerability in Quiz Maker Plugin for WordPress

CVE-2025-10042

What is CVE-2025-10042?

The Quiz Maker plugin for WordPress is vulnerable to an SQL Injection attack due to improper input validation and escaping of user-supplied parameters. This vulnerability arises when the plugin processes IP headers, especially in configurations that support retrieving the IP from fields like 'X-Forwarded-For'. Unauthenticated attackers can exploit this weakness to inject additional SQL commands into existing queries, potentially allowing unauthorized access to sensitive information stored within the database. It's crucial for site administrators to be aware of this risk and take necessary steps to secure their installations, particularly if IP address restrictions are enabled.

References