The Bob Watu Quiz plugin contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects all versions up to 3.4.1.2. An attacker with low privileges can exploit this vulnerability remotely without user interaction, potentially causing a partial breach of data confidentiality and minor disruption to availability. The CVSS 3.1 base score is 8.5, indicating high severity. No known exploits in the wild or vendor patches have been reported at this time.

Successful exploitation could allow an attacker with low privileges to execute unauthorized SQL commands, potentially exposing sensitive data (confidentiality impact is high) and causing limited disruption to service availability (availability impact is low). Integrity impact is not indicated. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable plugin and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the plugin to untrusted users where possible.