CVE-2025-10042

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10042", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-05T17:58:14.606Z", "datePublished": "2025-09-17T05:18:44.163Z", "dateUpdated": "2026-04-08T16:51:55.886Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:55.886Z"}, "affected": [{"vendor": "ays-pro", "product": "Quiz Maker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.7.0.56", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable in configurations where the server is set up to retrieve the IP from a user-supplied field like `X-Forwarded-For` and limit users by IP is enabled."}], "title": "Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eeae6dd-a41f-4878-aa92-064ec78367d7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.52/public/class-quiz-maker-public.php"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.52/public/class-quiz-maker-public.php#L7145"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.57/public/class-quiz-maker-public.php#L7149"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rahul Sreenivasan"}], "timeline": [{"time": "2025-09-05T18:13:27.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-16T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-17T12:47:55.443395Z", "id": "CVE-2025-10042", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-17T12:48:06.644Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10042", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-17T12:47:55.443395Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-17T12:48:00.482Z"}}], "cna": {"title": "Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "Rahul Sreenivasan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "ays-pro", "product": "Quiz Maker", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.7.0.56"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-05T18:13:27.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-16T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eeae6dd-a41f-4878-aa92-064ec78367d7?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.52/public/class-quiz-maker-public.php"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.52/public/class-quiz-maker-public.php#L7145"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.57/public/class-quiz-maker-public.php#L7149"}], "descriptions": [{"lang": "en", "value": "The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable in configurations where the server is set up to retrieve the IP from a user-supplied field like `X-Forwarded-For` and limit users by IP is enabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:55.886Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10042", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:55.886Z", "dateReserved": "2025-09-05T17:58:14.606Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-17T05:18:44.163Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Quiz Maker", "vendor": "ays-pro", "versions": [{"lessThanOrEqual": "6.7.0.56", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ays-pro:quiz_maker:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "AA044B85-B758-42D8-A250-AC9CD24E80A6", "versionEndExcluding": "6.7.0.57", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is only exploitable in configurations where the server is set up to retrieve the IP from a user-supplied field like `X-Forwarded-For` and limit users by IP is enabled."}, {"lang": "es", "value": "El plugin Quiz Maker para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s de encabezados IP falsificados en todas las versiones hasta, e incluyendo, la 6.7.0.56 debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes no autenticados a\u00f1adan consultas SQL adicionales a consultas ya existentes que pueden usarse para extraer informaci\u00f3n sensible de la base de datos. Esto solo es explotable en configuraciones donde el servidor est\u00e1 configurado para recuperar la IP de un campo proporcionado por el usuario como 'X-Forwarded-For' y la limitaci\u00f3n de usuarios por IP est\u00e1 habilitada."}], "id": "CVE-2025-10042", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10042", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-17T12:47:55.443395Z", "version": "2.0.3"}}]}, "published": "2025-09-17T06:15:43.030", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.52/public/class-quiz-maker-public.php"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.52/public/class-quiz-maker-public.php#L7145"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/quiz-maker/tags/6.7.0.57/public/class-quiz-maker-public.php#L7149"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4eeae6dd-a41f-4878-aa92-064ec78367d7?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:21:35.708047+00:00", "value": {"mitigation_remediation": ["Upgrade the Quiz Maker plugin to version 6.7.0.57 or later, which removes the vulnerability.", "Modify server or plugin configuration to disable IP\u2011based limiting, or ensure that the client IP is obtained only from the trusted network source rather than an untrusted header like X\u2011Forwarded\u2011For.", "Sanitize and validate any user\u2011supplied IP header fields before using them in database queries, applying strict whitelist checks on IP format."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated SQL Injection leading to data exfiltration"}, "threat_synthesis": {"affected_systems": "Affected systems are installations of the ays\u2011pro Quiz Maker plugin running on WordPress, specifically versions 6.7.0.56 and earlier. Any WordPress site that employs this plugin and has IP\u2011based limiting enabled, pulling the client IP from headers such as X\u2011Forwarded\u2011For, is susceptible. Higher versions released after 6.7.0.56 contain the fix.", "description_and_impact": "The vulnerability resides in the Quiz Maker WordPress plugin up to version 6.7.0.56, where insufficient escaping of a user-supplied parameter allows attackers to inject additional SQL queries by spoofing IP\u2011header fields. Attackers can append malicious statements to existing queries and read sensitive database contents without authentication. The flaw is a classic SQL Injection (CWE\u201189).", "risk_and_exploitability": "The CVSS score of 5.9 indicates a medium severity. The EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not currently listed in CISA\u2019s KEV catalog. Attackers need only to craft a request with a forged IP header to leverage the flaw; no authentication or privileged access is required. The risk is confined to data leakage rather than full system compromise."}}}}, "created": "2025-09-18T12:41:55.364329+00:00", "updated": "2026-04-22T13:30:17.922182+00:00", "vendors": ["ays-pro", "ays-pro$PRODUCT$quiz_maker", "wordpress", "wordpress$PRODUCT$wordpress"]}