CVE-2026-13767 is a SQL Injection vulnerability in the Quiz Master Next WordPress plugin (Quiz and Survey Master - QSM) affecting versions up to and including 11.2.0. The issue stems from insufficient escaping of the 'pages' parameter in the qsm_ajax_save_pages() AJAX handler, which only applies sanitize_text_field. The stored page IDs are then interpolated directly into an SQL IN() clause in qsm_options_questions_tab_content() without using $wpdb->prepare() or integer casting. Authenticated attackers with Author-level privileges who can edit a quiz can inject SQL payloads that execute secondarily when any user views the Questions tab of that quiz, enabling extraction of sensitive database information. No official patch or remediation level is currently documented.

An attacker with Author-level access or higher can inject malicious SQL code that executes when the quiz's Questions tab is viewed by any user, including administrators. This can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not affect availability or integrity directly but compromises confidentiality. The CVSS score of 6.5 reflects a medium severity impact with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level access to trusted users only and monitor for suspicious activity related to quiz editing and viewing. Avoid exposing the Questions tab to untrusted users. Follow vendor updates closely for an official fix or temporary mitigation.