The WpCues Basic Quiz WordPress plugin up to version 1.6.5 accepts quiz result submissions without sanitizing or escaping input values, which allows any user to inject SQL commands into the database query. An attacker can send a crafted request to the result submission endpoint and retrieve arbitrary data from the WordPress database, potentially exposing confidential site content, user credentials, or other sensitive information.

Any WordPress site that has the WpCues Basic Quiz plugin installed in a version equal to or earlier than 1.6.5 is affected. The vulnerability resides in the plugin’s quiz submission handler, so all sites with that plugin, regardless of theme or other plugins, are vulnerable.

The CVSS score for this vulnerability is 8.6, and the EPSS score is less than 1%, indicating a low probability of exploitation despite a high severity. The vulnerability can be exploited remotely through standard HTTP POST requests to the quiz result endpoint, and it does not require authentication. While no exploit code is currently documented, the potential impact of database compromise combined with the unprotected endpoint suggests a high risk if the site is publicly accessible.