The vulnerability is an SQL Injection flaw stemming from improper neutralization of special characters used in SQL commands within the ExpressTech Systems Quiz And Survey Master plugin. This weakness, identified as CWE‑89, permits an attacker to inject malicious SQL statements when interacting with the plugin’s input fields. Successful exploitation could allow unauthorized reading, modification, or deletion of database contents, potentially leading to full compromise of the WordPress site's data layer.

The affected product is ExpressTech Systems Quiz And Survey Master, a WordPress plugin known as quiz‑master‑next. Versions from the initial release through 10.2.4 are vulnerable. WordPress sites running any of these versions should be considered at risk.

The CVSS score of 8.5 indicates high severity, but the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog, further implying limited known exploitation. The likely attack vector is via crafted user input to the plugin’s survey or quiz forms, which directly feeds into SQL queries without proper sanitization.