CVE-2025-10042: Quiz Maker Plugin SQLi Vulnerability

CVE-2025-10042 Overview

The Quiz Maker plugin for WordPress contains a SQL Injection vulnerability that allows unauthenticated attackers to extract sensitive information from the database. The vulnerability exists in all versions up to and including 6.7.0.56 and is exploitable through spoofed IP headers such as X-Forwarded-For. Due to insufficient escaping of user-supplied parameters and lack of proper SQL query preparation, attackers can append malicious SQL queries to existing database operations.

Critical Impact

Unauthenticated attackers can extract sensitive data from the WordPress database including user credentials, personal information, and other confidential data stored by the Quiz Maker plugin or WordPress itself.

Affected Products

• ays-pro Quiz Maker versions up to and including 6.7.0.56
• WordPress sites using Quiz Maker with IP-based user limiting enabled
• Server configurations that retrieve client IP from user-supplied headers like X-Forwarded-For

Discovery Timeline

• 2025-09-17 - CVE-2025-10042 published to NVD
• 2025-12-19 - Last updated in NVD database

Technical Details for CVE-2025-10042

Vulnerability Analysis

This SQL Injection vulnerability stems from improper handling of user-controlled IP address headers within the Quiz Maker plugin. When administrators configure the plugin to limit quiz attempts by IP address, the plugin retrieves the client's IP from HTTP headers like X-Forwarded-For. This configuration is common in environments behind reverse proxies or load balancers.

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The attack requires no authentication and can be executed remotely over the network, though it depends on specific server configurations where IP-based limiting is enabled and the server trusts user-supplied IP headers.

Root Cause

The root cause is twofold: insufficient escaping of the user-supplied IP address parameter and lack of proper prepared statement usage in the SQL query construction. The vulnerable code in class-quiz-maker-public.php directly incorporates the IP address value from HTTP headers into SQL queries without adequate sanitization. When the server is configured to trust headers like X-Forwarded-For, attackers can inject arbitrary SQL syntax through this header value.

Attack Vector

The attack vector leverages the network-accessible nature of WordPress sites. An unauthenticated attacker can craft HTTP requests with malicious SQL payloads in the X-Forwarded-For header. When the Quiz Maker plugin processes these requests and the IP-limiting feature is enabled, the injected SQL is appended to legitimate database queries.

The vulnerability enables data extraction from the database but does not directly allow data modification or system compromise. Attackers typically use techniques like UNION-based or blind SQL injection to enumerate database contents, extract user tables, or retrieve WordPress configuration data.

The vulnerable code can be examined in the WordPress Quiz Maker source file at line 7145, with the patched version available at line 7149 in version 6.7.0.57.

Detection Methods for CVE-2025-10042

Indicators of Compromise

• Unusual or malformed values in X-Forwarded-For, X-Real-IP, or similar HTTP headers containing SQL syntax characters such as single quotes, UNION statements, or comment sequences
• Database query logs showing unexpected UNION, SELECT, or information_schema queries originating from Quiz Maker plugin operations
• Web server access logs with abnormally long or encoded X-Forwarded-For header values
• Unexplained database errors or slow query performance related to quiz-related tables

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in HTTP headers, particularly focusing on X-Forwarded-For and X-Real-IP
• Monitor WordPress database query logs for anomalous queries containing UNION SELECT, information_schema references, or sleep/benchmark functions
• Deploy intrusion detection signatures that flag HTTP requests with SQL metacharacters in IP-related headers
• Review Quiz Maker plugin logs for unusual quiz access patterns or repeated access attempts from suspicious IP addresses

Monitoring Recommendations

• Enable verbose logging for the WordPress database to capture all queries executed by the Quiz Maker plugin
• Configure SIEM alerts for SQL injection attack patterns targeting WordPress installations
• Implement rate limiting and anomaly detection for quiz submission endpoints
• Regularly audit web server logs for requests containing encoded or obfuscated payloads in header fields

How to Mitigate CVE-2025-10042

Immediate Actions Required

• Update Quiz Maker plugin to version 6.7.0.57 or later immediately
• If immediate patching is not possible, disable the "Limit users by IP" feature in Quiz Maker settings until the update is applied
• Review database access logs for any signs of exploitation prior to patching
• Consider temporarily disabling the Quiz Maker plugin if it is not business-critical until the update is verified

Patch Information

The vulnerability has been addressed in Quiz Maker version 6.7.0.57. The fix implements proper input sanitization and prepared statements for SQL queries involving IP address handling. Administrators should update through the WordPress plugin update mechanism or download the patched version from the WordPress plugin repository. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

• Disable the IP-based user limiting feature in Quiz Maker plugin settings until the patch can be applied
• Configure your web server or reverse proxy to sanitize or reject requests with malformed X-Forwarded-For headers before they reach WordPress
• Implement a Web Application Firewall with SQL injection detection rules specifically targeting HTTP header injection vectors
• If using a reverse proxy, configure it to set a trusted X-Forwarded-For value and strip any client-supplied values

# Apache configuration to set trusted X-Forwarded-For
# Add to .htaccess or Apache configuration
<IfModule mod_remoteip.c>
    RemoteIPHeader X-Forwarded-For
    RemoteIPTrustedProxy 10.0.0.0/8
    RemoteIPTrustedProxy 172.16.0.0/12
    RemoteIPTrustedProxy 192.168.0.0/16
</IfModule>