Is CVE-2026-6448 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6448 being exploited in the wild.

How severe is CVE-2026-6448?

Medium severity, with a CVSS score of 4.9, published 6 June 2026.

Which products and versions are affected?

ExpressTech Quiz and Survey Master up to, and including, 11.1.2.

Is there a fix for CVE-2026-6448?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6448 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6448?

Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6448: WordPress Quiz and Survey Master SQL injection in order parameter

CVE-2026-6448 · Severity: medium · CVSS 4.9 · Published 2026-06-06

The Quiz and Survey Master plugin for WordPress, which is used to create and manage online quizzes and surveys, contains a security flaw. An authorized user with administrative access could exploit this vulnerability to access sensitive information stored in the website's database. In certain configurations where a secret key is leaked, even lower-privileged users might be able to perform this attack, potentially leading to a broader data breach.

Technologies: ExpressTech Quiz and Survey Master. Vendors: ExpressTech.

Quick answers

Is CVE-2026-6448 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6448 being exploited in the wild.
How severe is CVE-2026-6448?: Medium severity, with a CVSS score of 4.9, published 6 June 2026.
Which products and versions are affected?: ExpressTech Quiz and Survey Master up to, and including, 11.1.2.
Is there a fix for CVE-2026-6448?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6448 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6448?: Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A time-based blind SQL injection vulnerability exists in the 'order' parameter of the Quiz and Survey Master (QSM) plugin for WordPress. The issue stems from insufficient escaping of user-supplied input and a lack of proper SQL query preparation within the QSM Quiz API. Authenticated attackers with administrator-level privileges can exploit this to append arbitrary SQL queries and extract sensitive data from the database. If the plugin's secret key is compromised, the vulnerability may also be exploitable by users with lower privilege levels. The issue is present in all versions up to and including 11.1.2.

Affected products

ExpressTech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker up to, and including, 11.1.2

Timeline

2026-06-06: disclosed: Initial publication of the CVE record.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.