CVE-2025-9318
Time-Based SQL Injection in Quiz and Survey Master Plugin
Publication date: 2026-01-06
Last updated on: 2026-01-06
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| quiz_and_survey_master | easy_quiz_and_survey_maker | to 10.3.1 (inc) |
| quiz_master_next | quiz_master_next | 10.2.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability is a time-based SQL Injection in the Quiz and Survey Master WordPress plugin (up to version 10.3.1) via the 'is_linking' parameter. Due to insufficient escaping and lack of proper preparation of this user-supplied parameter in SQL queries, authenticated users with Subscriber-level access or higher can append additional SQL commands to existing queries. This allows them to extract sensitive information from the database.
How can this vulnerability impact me? :
This vulnerability can allow an authenticated attacker with low-level access (Subscriber or above) to perform unauthorized SQL queries on the database, potentially extracting sensitive information. This could lead to data breaches, exposure of confidential quiz data, and compromise of user information stored in the database.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusual or unauthorized REST API requests to the Quiz and Survey Master plugin endpoints, especially those involving the 'is_linking' parameter. Since some GET endpoints are publicly accessible without authentication, you can look for requests to endpoints like /questions/, /questions/{id}, /quizzes/{id}/results, and /quizzes/{id}/emails. To detect potential exploitation attempts, you can use network monitoring tools or web server logs to search for suspicious SQL injection patterns or time-based delays in responses. For example, using curl to test the endpoints with crafted 'is_linking' parameters or using web application firewall (WAF) logs to identify SQL injection attempts. Specific commands might include: 1. Using curl to send requests to vulnerable endpoints: curl -X GET 'https://yourdomain.com/wp-json/quiz-survey-master/v1/questions/?is_linking=1' 2. Searching web server logs for suspicious 'is_linking' parameter usage: grep 'is_linking' /var/log/apache2/access.log 3. Using SQL injection detection tools or scanners against the REST API endpoints. Note: The provided resources do not include explicit detection commands but describe the vulnerable endpoints and parameters involved. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1. Restrict access to the vulnerable REST API endpoints by enforcing proper authentication and authorization checks, especially on GET endpoints that currently allow unauthenticated access. 2. Update the Quiz and Survey Master plugin to a version later than 10.3.1 where the vulnerability is fixed. 3. If an update is not immediately possible, consider disabling the plugin or blocking access to the vulnerable REST API endpoints via web server configuration or a web application firewall. 4. Monitor logs for suspicious activity related to the 'is_linking' parameter or unusual API requests. 5. Limit user roles and permissions to reduce the risk of authenticated attackers exploiting the vulnerability. These steps help prevent exploitation of the time-based SQL injection vulnerability via the 'is_linking' parameter. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows authenticated attackers with Subscriber-level access to perform time-based SQL Injection attacks that can extract sensitive information from the database. Additionally, some REST API endpoints expose sensitive quiz data without authentication, leading to unauthorized data disclosure. Such exposure and extraction of sensitive information can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access and breaches. [1]