CVE-2025-10042 describes an SQL Injection vulnerability in the Quiz Maker WordPress plugin by ays-pro, affecting all versions up to 6.7.0.56. The flaw arises from insufficient escaping of user-supplied parameters and lack of proper query preparation, specifically when IP addresses are retrieved from user-controlled headers such as X-Forwarded-For and IP-based user restrictions are active. This allows unauthenticated attackers to inject additional SQL queries into existing database commands, risking unauthorized data disclosure. The vulnerability is network exploitable without privileges or user interaction but requires high attack complexity due to specific server configuration dependencies.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not impact integrity or availability but compromises confidentiality. Exploitation requires the server to be configured to trust user-supplied IP headers and to enforce IP-based user restrictions, limiting the scope of affected deployments. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling IP-based user limiting or avoid relying on user-supplied IP headers such as X-Forwarded-For for security decisions. Applying strict input validation or using a web application firewall to block suspicious header manipulations may reduce risk. Monitor vendor channels for updates and apply patches promptly once released.