CVE-2026-2412 is an SQL Injection vulnerability in the Quiz and Survey Master (QSM) WordPress plugin, affecting all versions up to 10.3.5. The issue stems from improper neutralization of special SQL elements in the 'merged_question' parameter. The plugin applies sanitize_text_field() to user input, which does not prevent SQL metacharacters such as ), OR, AND, and #. This input is then directly concatenated into a SQL IN() clause without using $wpdb->prepare() or casting values to integers, enabling authenticated attackers with Contributor-level or higher privileges to append additional SQL queries. This can be exploited to extract sensitive information from the database. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), with network attack vector, low attack complexity, and requires privileges but no user interaction.

Successful exploitation allows authenticated users with Contributor-level access or higher to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect integrity or availability but impacts confidentiality. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access where possible and monitor for suspicious activity related to the 'merged_question' parameter. Avoid using vulnerable versions of the plugin if possible.