CVE-2026-89214 — WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission

CVE-2026-89214

WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission PUBLISHED

Description (CNA)

The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and read data from the database.

Affected (CNA)

Vendor / product	Versions
Unknown / WpCues Basic Quiz	affected 0 through 1.6.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/c5c57e38-61e9-456b-a56e-ef25146ee28f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.