A SQL injection vulnerability in the Quiz and Survey Master plugin has exposed more than 40,000 WordPress sites to potential database manipulation. The security flaw allowed any authenticated user with basic Subscriber privileges to interfere with database queries and access unauthorized data.

The vulnerability affected versions 10.3.1 and earlier of the popular Quiz and Survey Master (QSM) plugin. What makes this flaw particularly concerning is that it didn’t require administrative access. Any logged-in user could potentially exploit the weakness, significantly expanding the attack surface.

Quiz and Survey Master ranks among the most widely deployed WordPress plugins for creating interactive content. The plugin offers multimedia support and an intuitive drag-and-drop interface for building quizzes, surveys, and forms. This functionality has contributed to its substantial user base across tens of thousands of websites.

How the SQL Injection Flaw Worked

The vulnerability resided in a REST API function designed to retrieve quiz question data. Researchers identified that a request parameter called is_linking was treated as a numeric identifier without proper validation. The plugin inserted this value directly into database queries without sanitization.

This approach created a critical weakness. Malicious users could craft specially designed input containing additional SQL commands. Because the query wasn’t constructed using prepared statements, the database would execute the injected content as legitimate SQL code.

The result was a potential gateway for unauthorized data extraction or database manipulation. From a practical standpoint, this meant attackers could access sensitive information stored in the WordPress database without needing elevated privileges.

Scope and Impact of CVE-2025-67987

Security researchers assigned the vulnerability identifier CVE-2025-67987. While there’s no evidence of active exploitation in the wild, the flaw’s presence demonstrates the risks inherent in trusting user-supplied data without verification.

The vulnerability affected authenticated users at all permission levels, from basic Subscribers upward. This broad access requirement means that any compromised user account could serve as an entry point for exploitation. However, attackers still needed valid login credentials to leverage the flaw.

Patch Details and Timeline

Patchstack published a security advisory confirming that version 10.3.2 of Quiz and Survey Master resolves the vulnerability. The update addresses the issue by forcing the is_linking parameter through the intval function. This ensures only numeric values reach the database query.

Security researcher Doan Dinh Van discovered the flaw and reported it through the Patchstack Alliance community. Patchstack received the report on November 21, 2025, and immediately notified the plugin vendor. The patched version was released on December 4, 2025, with the public advisory following in late January 2026.

What This Means for WordPress Security

This incident reinforces fundamental security principles for WordPress plugin development. Input validation remains essential, regardless of whether data appears to come from trusted sources. Additionally, prepared statements should be the standard approach for database interactions.

Site administrators running Quiz and Survey Master should verify they’re using version 10.3.2 or later. The update process is straightforward through the WordPress admin dashboard. Delaying this update leaves sites vulnerable to potential database manipulation.

From a broader perspective, this vulnerability highlights the ongoing challenge of WordPress plugin security. With millions of sites relying on third-party extensions, even a single flawed plugin can create widespread risk. Regular updates and security monitoring are not optional—they’re essential components of site maintenance.

The goal isn’t just patching individual vulnerabilities. The goal is establishing processes that prevent similar issues from emerging in the first place. For plugin developers, this means adopting secure coding practices from the start. For site owners, it means maintaining vigilance and responding quickly when patches become available.

Original Source: www.infosecurity-magazine.com