ExploitPublished 25 Dec 2025

WordPress Quiz Maker 6.7.0.56 · SQL Injection

Source Exploit-DB RSS Feed

Severity

Medium

Rated by Threat Radar

Data as of 19 Jan 2026, 19:42 UTC

What to do

AI-suggested

Organizations should immediately inventory their WordPress installations to identify the presence of Quiz Maker plugin version 6.7.0.56. Until an official patch is released, consider disabling or uninstalling the vulnerable plugin to eliminate the attack vector. Implement web application firewalls (WAFs) with rules to detect and block SQL injection attempts targeting the plugin's endpoints. Conduct manual code audits or apply input validation and parameterized queries if custom modifications are possible. Monitor web server and application logs for suspicious query patterns or unusual database errors indicative of exploitation attempts. Employ least privilege principles for database access to limit the potential damage of successful injection. Regularly back up WordPress databases and files to enable recovery in case of compromise. Stay informed about updates from the plugin vendor and apply patches promptly once available. Educate site administrators about the risks of using outdated plugins and the importance of timely updates.

Description

WordPress Quiz Maker 6.7.0.56 - SQL Injection

Impact

For European organizations, this vulnerability could lead to unauthorized disclosure of sensitive data stored in WordPress databases, including user information, quiz results, and potentially administrative credentials if stored insecurely. Data integrity could be compromised by unauthorized modification or deletion of quiz content or user data, disrupting business operations and damaging trust. The ease of exploitation without authentication increases the risk of widespread attacks, especially against educational institutions, e-learning platforms, and content providers using this plugin. Regulatory compliance risks are significant, particularly under GDPR, as data breaches involving personal data could result in heavy fines and reputational damage. Additionally, exploitation could serve as a foothold for further attacks within the network, potentially leading to broader compromise. The impact on availability is moderate but could escalate if attackers corrupt database contents or cause denial of service through crafted queries.

Indicators of compromise

Exploit source code

Exploit code for WordPress Quiz Maker 6.7.0.56 - SQL Injection5,111 characters

# Exploit Title: WordPress Quiz Maker 6.7.0.56 - SQL Injection
# Date: 2025-12-16
# Exploit Author: Rahul Sreenivasan (Tr0j4n)
# Vendor Homepage: https://ays-pro.com/wordpress/quiz-maker
# Software Link: https://wordpress.org/plugins/quiz-maker/
# Version: <= 6.7.0.56
# Tested on: WordPress 6.x with Quiz Maker 6.7.0.56 on Ubuntu/Nginx/PHP-FPM
# CVE: CVE-2025-10042

from argparse import ArgumentParser
from requests import get
from requests.packages.urllib3 import disable_warnings
from requests.pa…

References

Community reviews

Loading reviews…