The Watu Quiz plugin for WordPress contains an input validation flaw that allows malicious users to inject arbitrary SQL statements. The vulnerability, identified as CWE-89, can enable an attacker to read, modify, or delete data stored in the WordPress database, and in some configurations could be leveraged for further code execution. The impact is a loss of confidentiality and integrity of the site’s data and potentially a full compromise of the underlying server if the database credentials allow system-level access.

This issue affects the Bob Watu Quiz plugin for WordPress, with versions from the earliest release up to and including 3.4.3. All installations of the plugin within that version range are potentially vulnerable. No specific vendor or operating system versions are listed, but the plugin operates on any WordPress site that supports the affected plugin.

The CVSS score of 7.6 indicates a high severity vulnerability. The EPSS score of less than 1% suggests that exploitation has not yet been widely observed, but this does not remove the risk of a targeted attack. The vulnerability is not listed in the CISA KEV catalog, making it less likely to have known active exploits. The likely attack vector is via the web interface of the WordPress site, where an attacker could submit crafted input to the plugin’s quiz creation or editing forms to inject SQL code. No authentication is required to target the exposed endpoint if the plugin does not enforce normal user access controls.