# CVE-2026-6448: WordPress Quiz and Survey Master SQL injection in order parameter Source: https://junglewise.ai/threats/cve-2026-6448-wordpress-quiz-and-survey-master-sql-injection-in-order-parameter Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-06-06. Updated: 2026-06-06 License: CC BY 4.0 with a link back CVE-2026-6448 · Severity: medium · CVSS 4.9 · Published 2026-06-06 The Quiz and Survey Master plugin for WordPress, which is used to create and manage online quizzes and surveys, contains a security flaw. An authorized user with administrative access could exploit this vulnerability to access sensitive information stored in the website's database. In certain configurations where a secret key is leaked, even lower-privileged users might be able to perform this attack, potentially leading to a broader data breach. Technologies: [ExpressTech Quiz and Survey Master](https://junglewise.ai/threats/technologies/quiz-and-survey-master). Vendors: [ExpressTech](https://junglewise.ai/threats/vendors/expresstech). ## Quick answers **Is CVE-2026-6448 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6448 being exploited in the wild. **How severe is CVE-2026-6448?** Medium severity, with a CVSS score of 4.9, published 6 June 2026. **Which products and versions are affected?** ExpressTech Quiz and Survey Master up to, and including, 11.1.2. **Is there a fix for CVE-2026-6448?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it. **How is CVE-2026-6448 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-6448?** Check whether you run ExpressTech Quiz and Survey Master at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## Technical details A time-based blind SQL injection vulnerability exists in the 'order' parameter of the Quiz and Survey Master (QSM) plugin for WordPress. The issue stems from insufficient escaping of user-supplied input and a lack of proper SQL query preparation within the QSM Quiz API. Authenticated attackers with administrator-level privileges can exploit this to append arbitrary SQL queries and extract sensitive data from the database. If the plugin's secret key is compromised, the vulnerability may also be exploitable by users with lower privilege levels. The issue is present in all versions up to and including 11.1.2. ## Affected products - ExpressTech Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker up to, and including, 11.1.2 ## Timeline - 2026-06-06: disclosed: Initial publication of the CVE record. ## References - [https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php](https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php) - [https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php](https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php) - [https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php](https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php) - [https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php](https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php) - [https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php](https://plugins.trac.wordpress.org/browser/quiz-master-next/tags/10.3.5/php/classes/class-qsm-quiz-api.php) - [https://plugins.trac.wordpress.org/browser/quiz-master-next/trunk/php/classes/class-qsm-quiz-api.php](https://plugins.trac.wordpress.org/browser/quiz-master-next/trunk/php/classes/class-qsm-quiz-api.php) - [https://plugins.trac.wordpress.org/browser/quiz-master-next/trunk/php/classes/class-qsm-quiz-api.php](https://plugins.trac.wordpress.org/browser/quiz-master-next/trunk/php/classes/class-qsm-quiz-api.php) ## Related threats - [ExpressTech Quiz And Survey Master broken access control](https://junglewise.ai/threats/cve-2026-125787-missing-authorization-vulnerability-in-expresstech-quiz-and) - [ExpressTech Quiz And Survey Master XSS in content injection](https://junglewise.ai/threats/cve-2026-125786-improper-neutralization-of-script-related-html-tags-in-a-web) - [ExpressTech Quiz And Survey Master object injection](https://junglewise.ai/threats/cve-2026-111408-deserialization-of-untrusted-data-vulnerability-in-expresstech) - [ExpressTech Quiz And Survey Master DOM-based XSS](https://junglewise.ai/threats/cve-2026-107862-improper-neutralization-of-input-during-web-page-generation) - [ExpressTech Quiz And Survey Master object injection in deserialization](https://junglewise.ai/threats/cve-2026-104392-deserialization-of-untrusted-data-vulnerability-in-expresstech)