CVE-2026-2412: 
WordPress vulnerability analysis and mitigation

CVE-2026-2412 is a SQL Injection vulnerability in the Quiz and Survey Master (QSM) plugin for WordPress, affecting all versions up to and including 10.3.5. The flaw allows authenticated attackers with Contributor-level access or above to extract sensitive information from the database by appending malicious SQL queries via the merged_question parameter. It was published on March 23, 2026, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium/High) (Wordfence, ENISA EUVD).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The merged_question parameter is sanitized using WordPress's sanitize_text_field() function, which does not strip SQL metacharacters such as ), OR, AND, and #. The sanitized value is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers, enabling SQL injection. The vulnerable code paths are located in php/classes/class-qsm-questions.php (line 387) and php/rest-api.php (line 760) of version 10.3.5 (Wordfence, WordPress Trac).

Successful exploitation allows authenticated attackers to extract sensitive information from the WordPress database, potentially including user credentials, email addresses, private post content, and other confidential site data. The vulnerability has a high confidentiality impact with no integrity or availability impact, meaning it is primarily a data exfiltration risk. While lateral movement is not directly enabled, exposed credentials could facilitate further compromise of the WordPress site or associated infrastructure (Wordfence, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-2412 as of the available data. The EPSS score is approximately 0.027%, indicating a low probability of exploitation in the near term. The vulnerability requires at least Contributor-level authentication, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Quiz and Survey Master (QSM) plugin version 10.3.5 or earlier using tools like WPScan or by inspecting plugin directories.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Identify the vulnerable endpoint: Locate the REST API endpoint or form handler that processes the merged_question parameter (found in php/rest-api.php).
4. Craft a malicious payload: Construct a SQL injection payload exploiting the unsanitized merged_question parameter, e.g., appending OR 1=1# or using UNION-based or boolean-based injection to extract data from the wp_users table.
5. Submit the payload: Send the crafted request to the vulnerable endpoint with the malicious merged_question value directly concatenated into the SQL IN() clause.
6. Extract data: Parse the application's response to retrieve sensitive database contents such as usernames, hashed passwords, or other confidential records (Wordfence, WordPress Trac).

• Network: Unusual or repeated REST API requests to QSM plugin endpoints containing SQL metacharacters (e.g., OR, AND, #, )) in the merged_question parameter; anomalous query patterns from authenticated low-privilege accounts.
• Logs: WordPress access logs showing POST/GET requests to QSM REST API routes with encoded or plaintext SQL injection strings; database error logs indicating malformed SQL queries originating from the QSM plugin.
• File System: No direct file system artifacts expected for this read-only SQL injection; however, monitor for unexpected file creation if exploitation is chained with other vulnerabilities.
• Database: Unusual or high-volume SELECT queries against sensitive tables (e.g., wp_users, wp_usermeta) originating from QSM plugin database calls.

Users should update the Quiz and Survey Master (QSM) plugin to a version beyond 10.3.5, which includes the fix applied in the changeset that replaces direct string concatenation with proper use of $wpdb->prepare() and integer casting in both php/rest-api.php and php/classes/class-qsm-questions.php. As a temporary workaround, site administrators can restrict Contributor-level user registration or disable the QSM plugin until patching is feasible. Implementing a Web Application Firewall (WAF) with SQL injection rules can also help mitigate exploitation attempts (Wordfence, WordPress Trac Changeset).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for the period of March 23–29, 2026, noting the SQL injection risk for sites with open contributor registration (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified.