CVE-2026-13422 is a Cross-Site Request Forgery vulnerability in the HD Quiz WordPress plugin by harmonic_design affecting versions 2.2.0 through 2.2.1. The issue arises from missing or incorrect nonce validation in the hdq_validate_nonce function, enabling attackers to perform unauthorized state-changing operations by tricking authenticated administrators into submitting crafted requests. This can lead to unauthorized modification, creation, or deletion of quizzes and plugin settings. The vulnerability does not impact confidentiality or availability but affects integrity. No known exploits are reported in the wild, and no official fix or patch has been disclosed as of the publication date.

An attacker can exploit this vulnerability to cause an authenticated administrator to unknowingly perform actions such as deleting or modifying quizzes and questions, creating new quizzes, or changing plugin settings. This impacts the integrity of the affected site’s quiz data and configuration. There is no direct impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution when interacting with untrusted links or requests while logged into the WordPress admin interface. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended.