CVE-2025-9318: 
WordPress vulnerability analysis and mitigation

CVE-2025-9318 is a time-based SQL Injection vulnerability in the Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress, affecting all versions up to and including 10.3.1. The flaw exists in the is_linking parameter due to insufficient input escaping and lack of proper SQL query preparation. It was discovered and reported by Wordfence, published on January 6, 2026, and received an initial NVD analysis on January 9, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, NVD).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause is insufficient escaping of the user-supplied is_linking parameter combined with a lack of prepared statements in the plugin's REST API handler, as seen in rest-api.php at line 533. An authenticated attacker with at minimum Subscriber-level access can append additional SQL queries to existing ones using time-based blind SQL injection techniques, allowing them to enumerate and extract data from the WordPress database without triggering visible errors (Wordfence, WordPress Trac).

Successful exploitation allows authenticated attackers to extract sensitive information from the WordPress database, including user credentials (hashed passwords), email addresses, plugin configuration data, and other stored content. The impact is limited to confidentiality — integrity and availability are not directly affected by this vulnerability. However, extracted credentials or sensitive data could enable further attacks such as account takeover or privilege escalation within the WordPress environment (Wordfence, NVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-9318 as of the available data. The EPSS score is approximately 0.026%, indicating a low probability of exploitation in the near term. The vulnerability requires at least Subscriber-level authentication, which somewhat limits the attack surface compared to unauthenticated vulnerabilities. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Quiz and Survey Master (QSM) plugin version 10.3.1 or earlier using tools like WPScan or by checking the plugin's readme.txt file at wp-content/plugins/quiz-master-next/readme.txt.
2. Obtain Subscriber-level access: Register a standard user account on the target WordPress site (if open registration is enabled) or use compromised low-privilege credentials.
3. Identify the vulnerable REST API endpoint: Locate the REST API route that processes the is_linking parameter, as exposed in the plugin's rest-api.php file.
4. Craft a time-based SQL injection payload: Append a time-delay SQL payload (e.g., using SLEEP() in MySQL) to the is_linking parameter in an authenticated REST API request, such as: is_linking=1 AND SLEEP(5)--.
5. Enumerate database contents: Use automated tools like sqlmap with session cookies to systematically extract database tables, user credentials, and other sensitive data via the time-based blind injection channel.
6. Exfiltrate data: Retrieve WordPress user hashes, email addresses, or other sensitive records from the database for offline cracking or further exploitation (Wordfence, WordPress Trac).

• Network: Unusual authenticated REST API requests to QSM plugin endpoints containing SQL keywords (SLEEP, BENCHMARK, AND, OR, UNION) in the is_linking parameter; repeated requests with incrementally varying time delays suggesting time-based blind injection probing.
• Logs: WordPress or web server access logs showing multiple REST API calls from the same authenticated user with anomalous query strings targeting QSM endpoints; unusually high response times on specific API requests consistent with SLEEP() injection.
• Process: Database server (MySQL/MariaDB) showing elevated query execution times or repeated SLEEP() function calls originating from WordPress database connections.

Users should update the Quiz and Survey Master (QSM) plugin to version 10.3.2 or later, which addresses the insufficient escaping and lack of prepared statements in the vulnerable SQL query. No official configuration-based workaround has been published; the recommended action is to apply the patch immediately. Site administrators should also audit user registration settings to limit Subscriber-level account creation if not required, reducing the potential attacker pool (Wordfence, NVD).

Wordfence disclosed the vulnerability and published it in their weekly WordPress vulnerability report covering January 5–11, 2026, highlighting it as part of a broader set of WordPress plugin issues identified that week (Wordfence Weekly Report). The vulnerability received standard aggregation coverage from security databases including VulDB, Vulners, and CIRCL, with no notable independent researcher commentary or significant social media discussion beyond automated CVE tracking accounts.