CVE-2025-6739: Bauc Wpquiz SQL Injection Vulnerability

CVE-2025-6739 Overview

CVE-2025-6739 is a SQL injection vulnerability in the WPQuiz plugin for WordPress, affecting all versions up to and including 0.4.2. The flaw resides in the id attribute of the wpquiz shortcode. The plugin fails to escape user-supplied input and does not properly prepare the underlying SQL query. Authenticated users with Contributor-level access or higher can append arbitrary SQL statements to the existing query. Successful exploitation allows attackers to extract sensitive data from the WordPress database, including user credentials, session tokens, and configuration secrets.

Critical Impact
Contributor-level authenticated attackers can exfiltrate arbitrary database contents through injected SQL queries embedded in the wpquiz shortcode.

Affected Products

Bauc WPQuiz plugin for WordPress, all versions through 0.4.2
WordPress sites permitting Contributor role or higher account creation
Any WordPress deployment using the wpquiz shortcode

Discovery Timeline

2025-07-04 - CVE-2025-6739 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6739

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89]. It occurs when the WPQuiz plugin processes the id attribute passed to the wpquiz shortcode. The plugin concatenates this attribute into a SQL query without applying escaping functions such as esc_sql() or using $wpdb->prepare() with proper placeholders.

Because the injection point is the id attribute of a shortcode, exploitation requires the ability to insert shortcodes into post or page content. WordPress grants this capability to Contributor and higher roles by default. Attackers can craft posts containing a malicious wpquiz shortcode and trigger evaluation of the injected SQL when the content is rendered.

Root Cause

The root cause is insufficient input sanitization combined with improper query preparation. The plugin trusts the shortcode attribute as a well-formed integer identifier. It passes the raw string into a SELECT statement without parameter binding. This design permits attackers to break out of the intended query context and append UNION SELECT clauses or stacked subqueries.

Attack Vector

Exploitation proceeds over the network and requires authenticated access at Contributor level. An attacker creates or edits a post containing the wpquiz shortcode. The id attribute is populated with a payload such as a UNION SELECT clause referencing the wp_users table. When WordPress renders the post, the plugin executes the concatenated query and returns attacker-controlled results within the quiz output or through blind inference.

The vulnerability enables extraction of password hashes from wp_users, secret keys from wp_options, and session tokens from wp_usermeta. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-6739

Indicators of Compromise

Post or page revisions containing the wpquiz shortcode with non-numeric id attribute values
Web server access logs recording POST requests to /wp-admin/post.php or /wp-admin/post-new.php with SQL keywords such as UNION, SELECT, or SLEEP in the body
Database query logs showing malformed SELECT statements originating from the WPQuiz plugin context
Unexpected outbound traffic from the WordPress host following post preview or publish actions

Detection Strategies

Inspect wp_posts content for the wpquiz shortcode with id values containing quotes, whitespace, or SQL keywords
Enable WordPress database query logging and alert on queries referencing wp_users or wp_options originating from front-end rendering flows
Deploy a web application firewall rule that inspects shortcode attributes for SQL metacharacters

Monitoring Recommendations

Audit all Contributor, Author, and Editor accounts for recent post creation activity
Monitor authentication logs for successful logins from unusual IP addresses to low-privilege accounts
Track plugin file integrity to identify tampering with WPQuiz source files

How to Mitigate CVE-2025-6739

Immediate Actions Required

Deactivate the WPQuiz plugin until a patched version is confirmed available on the WordPress Plugin Directory
Review and remove any suspicious posts containing wpquiz shortcodes with non-numeric id values
Rotate WordPress secret keys defined in wp-config.php and force password resets for all administrative accounts
Restrict Contributor and higher role assignments to trusted users only

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for versions above 0.4.2. Administrators should monitor the WordPress WP Quiz Plugin page and the Wordfence Vulnerability Analysis for updated remediation guidance.

Workarounds

Uninstall the WPQuiz plugin entirely if quiz functionality is not business-critical
Configure a web application firewall to block SQL metacharacters in shortcode attributes
Restrict post creation capabilities by removing the edit_posts capability from the Contributor role using a role management plugin
Enforce database user least privilege by ensuring the WordPress database user cannot access non-WordPress schemas

bash

# Disable the WPQuiz plugin via WP-CLI
wp plugin deactivate wpquiz
wp plugin delete wpquiz

# Audit posts for suspicious wpquiz shortcode usage
wp db query "SELECT ID, post_author, post_title FROM wp_posts WHERE post_content LIKE '%[wpquiz%' AND post_content REGEXP '[wpquiz[^]]*id=\"[^0-9\"]';"