CVE-2026-89214

Summary

The WpCues Basic Quiz plugin has a SQL injection vulnerability that allows unauthenticated attackers to read database contents. This occurs because the plugin fails to properly sanitize input before using it in SQL queries.

Exploitability

Exploitation is relatively straightforward as attackers don't need authentication and can trigger the vulnerability through specific API endpoints, requiring only basic HTTP request capabilities.

Blast radius

If exploited, attackers could access sensitive quiz data, user information, and potentially other database contents that the plugin stores, affecting all WordPress sites using the vulnerable plugin version.

Detection

Monitor for unusual SQL query patterns in database logs or application logs that show parameterized queries with unescaped values, particularly around quiz-related endpoints.

Prioritized remediation

Upgrade to version 1.6.6 or later which contains the SQL injection fix for the WpCues Basic Quiz plugin.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.