Is CVE-2026-13767 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13767 being exploited in the wild.

How severe is CVE-2026-13767?

Medium severity, with a CVSS score of 6.5, published 16 July 2026.

Which products and versions are affected?

ExpressTech Quiz and Survey Master up to, and including, 11.2.0.

Is there a fix for CVE-2026-13767?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-13767 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13767?

Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13767: ExpressTech Quiz Master Next SQL injection in Questions tab

CVE-2026-13767 · Severity: medium · CVSS 6.5 · Published 2026-07-16

The Quiz Master Next plugin for WordPress, used for creating quizzes and surveys, contains a security flaw that allows users with Author-level access to inject malicious database commands. By saving specially crafted quiz page data, an attacker can trick the system into revealing sensitive information from the website's database. This occurs when an administrator or another user views the affected quiz's settings, potentially leading to the exposure of private site data.

Technologies: ExpressTech Quiz and Survey Master. Vendors: ExpressTech.

Quick answers

Is CVE-2026-13767 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13767 being exploited in the wild.
How severe is CVE-2026-13767?: Medium severity, with a CVSS score of 6.5, published 16 July 2026.
Which products and versions are affected?: ExpressTech Quiz and Survey Master up to, and including, 11.2.0.
Is there a fix for CVE-2026-13767?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-13767 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13767?: Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Quiz Master Next plugin for WordPress is vulnerable to a second-order SQL Injection due to insufficient input validation and output escaping. Specifically, the 'qsm_ajax_save_pages()' AJAX handler uses only 'sanitize_text_field()' on the 'pages' parameter, which is insufficient for preventing SQL injection when the data is later used in a query. The stored page IDs are subsequently interpolated into an IN() clause via 'implode()' in 'qsm_options_questions_tab_content()' without integer casting or the use of '$wpdb->prepare()'. Authenticated attackers with Author-level permissions can exploit this to plant a payload that executes when any user views the quiz's Questions tab, allowing for the extraction of sensitive database information.

Affected products

ExpressTech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker up to, and including, 11.2.0

Timeline

2026-07-16: disclosed: Initial publication of the CVE record.
2026-07-16: advisory: Wordfence published the vulnerability details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.