CVE-2026-13422 is a CSRF vulnerability in the HD Quiz WordPress plugin by harmonic_design affecting version 2.2.0. The issue arises from missing or incorrect nonce validation in the hdq_validate_nonce function, which is intended to protect against unauthorized requests. Exploitation requires tricking an authenticated site administrator into executing a malicious request, enabling attackers to modify quizzes, questions, and plugin settings without direct authentication. No official patch or remediation level has been confirmed as of the published date.

An attacker can cause an authenticated administrator to unknowingly perform actions such as deleting or modifying quizzes and questions, creating new quizzes, or changing plugin settings. This can lead to unauthorized content manipulation within the affected WordPress site. There is no indication of confidentiality or availability impact, only integrity is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with links and requests that could trigger plugin actions, and consider disabling or restricting access to the HD Quiz plugin if possible.