The WordPress Quiz Maker plugin has been found to have a severe SQL injection vulnerability that could allow an unauthenticated attacker to retrieve sensitive information from the database, including administrator password information.
The vulnerability is identified as CVE-2025-10042. Any versions of the Quiz Maker plugin earlier than version 6.7.0.56 are affected. It is attributed to not properly validating user input that is submitted via HTTP header parameters when using the quiz endpoints.
Root Cause of the Issue
The vulnerability exists because the Quiz Maker plugin does not properly validate any user input values (e.g., X-Forwarded-For) that are submitted via HTTP headers. When queries are built with these unvalidated user input values, they are then sent directly to the database for execution without proper input validation or prepared statements.
As a consequence, it may be possible for an attacker to send malicious SQL commands to the database that would be executed.
Method of Attack
The attack technique involves using a time-based blind SQL Injection (SQLI), which is useful in situations where an identified failure will not show any results due to lack of visible information returned from either a database error message returned by the database server or the query.
Using the demonstrated attack, an attacker uses time-based SQLI to create conditional SLEEP() statements and then measures the amount of time it takes to execute the created statements. This is how an attacker can do the following:
1. Determine whether there is a SQLI vulnerability.
2. Identify a database entry by character-by-character discovery.
3. Extract sensitive information such as usernames, email addresses, passwords and hashes of password entries in the wp_users table, along with administrator login information.
When someone uses a vulnerable WordPress site to gain unauthorized access, they can cause the following outcomes:
1. They could potentially discover your WordPress admin. Login information (usernames/email).
2. They could retrieve password hashes to be cracked later offline.
3. Gain full administrative rights over your WordPress site.
4. Modify your website's content and add malware or access to sensitive data.
Because the attacker leverages differences in timing for their attack, which allows them to perform everything without needing authentication, they can make it even harder for the average user to detect their actions via typical logging or alerting methods.
Affected Environment:
1. WordPress version 6.x
2. Quiz Maker plugin (version ≤ 6.7.0.56)
3. PHP/Nginx hosting stacks, which are typically used by many web servers.
The main reason for the exploit was due to injecting unvalidated data through HTTP header manipulation, failure to use prepared statements in the application code and not performing proper input validation before inserting into a database.
To reduce the risks of this exploit, we recommend that you keep a close watch for updates from the developers of the Quiz Maker plugin whenever a new version is released that has an update associated with it. In addition to this, we recommend implementing WAF rule sets to block unwanted or suspicious-looking HTTP headers from reaching your web server.
You should also monitor for unusual timing on requests (for example, timing attacks). Lastly, we suggest changing your administrator password in the event that you believe that an administrator has potentially been compromised in some way.
The Security Researcher responsible for discovering this exploit is Rahul Sreenivasan (Tr0j4n) who responsibly disclosed this information.
Source: Exploit DB
