CVE-2026-2412

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2412", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-12T16:12:41.339Z", "datePublished": "2026-03-23T22:25:39.767Z", "dateUpdated": "2026-04-08T17:16:36.412Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:36.412Z"}, "affected": [{"vendor": "expresstech", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "10.3.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters like ), OR, AND, and # from being included in the value, which is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b32bf1cb-3722-41fc-be51-dabe80416b14?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-questions.php#L387"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/rest-api.php#L760"}, {"url": "https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/rest-api.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/classes/class-qsm-questions.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Thanh Hao"}], "timeline": [{"time": "2026-03-23T10:09:13.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-24T18:44:37.199895Z", "id": "CVE-2026-2412", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T18:44:44.723Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2412", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-24T18:44:37.199895Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-24T18:44:41.538Z"}}], "cna": {"title": "Quiz and Survey Master (QSM) <= 10.3.5 - Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Thanh Hao"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "expresstech", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "10.3.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-23T10:09:13.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b32bf1cb-3722-41fc-be51-dabe80416b14?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-questions.php#L387"}, {"url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/rest-api.php#L760"}, {"url": "https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/rest-api.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/classes/class-qsm-questions.php"}], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters like ), OR, AND, and # from being included in the value, which is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:16:36.412Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2412", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:16:36.412Z", "dateReserved": "2026-02-12T16:12:41.339Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-23T22:25:39.767Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "vendor": "expresstech", "versions": [{"lessThanOrEqual": "10.3.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to SQL Injection via the 'merged_question' parameter in all versions up to, and including, 10.3.5. This is due to insufficient sanitization of user-supplied input before being used in a SQL query. The sanitize_text_field() function applied to the merged_question parameter does not prevent SQL metacharacters like ), OR, AND, and # from being included in the value, which is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin Quiz and Survey Master (QSM) para WordPress es vulnerable a inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro 'merged_question' en todas las versiones hasta la 10.3.5, inclusive. Esto se debe a una sanitizaci\u00f3n insuficiente de la entrada proporcionada por el usuario antes de ser utilizada en una consulta SQL. La funci\u00f3n sanitize_text_field() aplicada al par\u00e1metro merged_question no evita que metacaracteres SQL como ), OR, AND y # se incluyan en el valor, el cual es luego concatenado directamente en una cl\u00e1usula SQL IN() sin usar $wpdb-&gt;prepare() ni convertir valores a enteros. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden ser utilizadas para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2026-2412", "lastModified": "2026-06-17T10:30:54.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2412", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-24T18:44:37.199895Z", "version": "2.0.3"}}]}, "published": "2026-03-23T23:17:11.287", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-questions.php#L387"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/rest-api.php#L760"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/classes/class-qsm-questions.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3486710/quiz-master-next/trunk/php/rest-api.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b32bf1cb-3722-41fc-be51-dabe80416b14?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,10.3.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Quiz and Survey Master (QSM) \u2013 Easy Quiz and Survey Maker", "source": "cna", "vendor": "expresstech"}, "product": "quiz_and_survey_master_(qsm)_\u2013_easy_quiz_and_survey_maker", "vendor": "expresstech"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-24T03:55:57.821367+00:00", "value": {"mitigation_remediation": ["Update Quiz and Survey Master to the newest available version of the plugin.", "If an upgrade is not immediately possible, restrict or temporarily remove Contributor capabilities from affected accounts.", "Monitor database logs for unexpected queries or failed login attempts.", "Implement a web application firewall rule that blocks suspicious SQL injection patterns.", "Verify that after updating, the merged_question parameter no longer accepts malicious input."], "summary": {"action": "Immediate Patch", "impact": "SQL injection that can expose database content"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the Quiz and Survey Master plugin by expresstech installed with a version number of 10.3.5 or earlier are vulnerable. No information is provided about whether later releases contain a fix, but the documented affected range stops at 10.3.5.", "description_and_impact": "A vulnerability in the Quiz and Survey Master plugin allows an authenticated user with Contributor or higher permissions to inject arbitrary SQL through the merged_question parameter. The lack of proper escaping or prepared statements permits inclusion of SQL metacharacters such as ), OR, AND, and #, leading to extraction of sensitive data stored in the database. This attack compromises the confidentiality of all data accessed through the plugin, potentially exposing user information or quiz results.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity. EPSS information is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be authenticated as a Contributor or higher; no additional network or configuration prerequisites are described. Consequently, the threat remains medium, escalating if the site contains highly sensitive information."}}}}, "created": "2026-03-24T10:30:07.042685+00:00", "updated": "2026-03-25T20:36:14.662524+00:00", "vendors": ["expresstech", "expresstech$PRODUCT$quiz_and_survey_master_(qsm)_\u2013_easy_quiz_and_survey_maker", "wordpress", "wordpress$PRODUCT$wordpress"]}