CVE-2024-6028 is a critical SQL Injection vulnerability in the ays-pro Quiz Maker WordPress plugin affecting all versions up to 6.5.8.3. The issue stems from improper neutralization of special elements in the 'ays_questions' parameter, which is not properly escaped or prepared before inclusion in SQL queries. This allows unauthenticated attackers to append malicious SQL commands, potentially extracting sensitive data from the backend database. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation guidance is currently provided in the vendor or advisory data.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database, full compromise of data integrity, and potential denial of service due to database manipulation. The attack requires no authentication and can be performed remotely over the network, increasing the risk and ease of exploitation. The critical CVSS score (9.8) reflects the high impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable plugin or restricting access to it to trusted users only. Monitoring for unusual database activity and applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'ays_questions' parameter may provide temporary mitigation.