CVE-2024-6028 – The Quiz Maker WordPress plugin contains a time... (How to Fix)

📋 TL;DR

The Quiz Maker WordPress plugin contains a time-based SQL injection vulnerability in the 'ays_questions' parameter that allows unauthenticated attackers to execute arbitrary SQL queries. This can lead to extraction of sensitive database information like user credentials, quiz data, and other WordPress content. All WordPress sites using Quiz Maker versions up to 6.5.8.3 are affected.

💻 Affected Systems

Products:

Quiz Maker WordPress Plugin

Versions: All versions up to and including 6.5.8.3

Operating Systems: All operating systems running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Any WordPress installation with the vulnerable Quiz Maker plugin enabled is affected regardless of configuration.

📦 What is this software?

Quiz Maker by Ays Pro

View all CVEs affecting Quiz Maker →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including administrator credentials, sensitive user data, and potential privilege escalation leading to full site takeover.

🟠

Likely Case

Extraction of sensitive quiz data, user information, and potentially WordPress authentication credentials leading to unauthorized access.

🟢

If Mitigated

Limited impact with proper network segmentation, database permissions, and monitoring in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Time-based SQL injection requires no authentication and can be automated with readily available tools.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 6.5.8.4

Vendor Advisory: https://wordpress.org/plugins/quiz-maker/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find Quiz Maker plugin
4. Click 'Update Now' if available
5. If no update appears, manually download version 6.5.8.4+ from WordPress.org
6. Deactivate old plugin, upload new version, activate

🔧 Temporary Workarounds

Disable Quiz Maker Plugin

all

Temporarily deactivate the vulnerable plugin until patched

wp plugin deactivate quiz-maker

Web Application Firewall Rule

all

Block requests containing suspicious SQL injection patterns targeting the ays_questions parameter

🧯 If You Can't Patch

Implement strict network access controls to limit plugin exposure
Enable database query logging and monitoring for suspicious SQL patterns

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Quiz Maker version number. If version is 6.5.8.3 or lower, you are vulnerable.

Check Version:

wp plugin get quiz-maker --field=version

Verify Fix Applied:

Verify Quiz Maker plugin version is 6.5.8.4 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual database query patterns with time delays
Multiple requests to quiz-maker endpoints with SQL-like parameters
Database error logs showing malformed SQL

Network Indicators:

HTTP requests containing 'ays_questions' parameter with SQL syntax
Unusual timing patterns in responses from quiz endpoints

SIEM Query:

source="web_logs" AND uri="*quiz-maker*" AND (param="*ays_questions*" AND (value="*SLEEP*" OR value="*WAITFOR*" OR value="*BENCHMARK*"))

📊 Metadata

CVE ID: CVE-2024-6028

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: June 25, 2024

Last Updated: December 15, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-6028, you might also want to check these: