The WPQuiz plugin for WordPress contains a SQL Injection flaw in the handling of the 'id' attribute in the 'wpquiz' shortcode. Because the plugin fails to properly escape user‐supplied data before embedding it in an existing SQL statement, an attacker can append arbitrary SQL queries. This allows the attacker to read sensitive data from the database, compromising confidentiality. The weakness is a classic injection flaw (CWE-89).

Vulnerable versions of the WPQuiz plugin up to and including 0.4.2 are affected. The plugin is available from the bauc provider in the WordPress ecosystem and is distributed under the WordPress plugin repository. Systems with any WordPress site running these plugin versions can be impacted.

The vulnerability receives a CVSS base score of 6.5, indicating moderate severity, and an EPSS score of less than 1%, reflecting a low likelihood of exploitation at present. It is not listed in the CISA KEV catalog. The attack requires authentication and a minimum contributor-level role, so it is not publicly exploitable. Successful exploitation would enable the attacker to execute read‑only queries that expose private database contents.