SQL Injection Vulnerability in Quiz and Survey Master Plugin for WordPress

CVE-2026-116509

What is CVE-2026-116509?

The Quiz and Survey Master plugin for WordPress is susceptible to SQL injection through the 'qpages' parameter in versions 11.2.9 and earlier. This vulnerability arises from inadequate escaping of user inputs and insufficient query preparation, allowing authenticated users with contributor access or higher to manipulate SQL queries. This exploitation can lead to unauthorized data extraction from the database. The potential for payload persistence further exacerbates the risk, as the framework fails to properly validate non-numeric IDs, facilitating the injection of malicious SQL commands into existing queries.

References