SQL Injection Vulnerability in WP-Polls Plugin for WordPress

CVE-2024-13426

What is CVE-2024-13426?

The WP-Polls plugin for WordPress contains a vulnerability that enables SQL Injection through COOKIE manipulation. This issue arises from inadequate escaping of user-supplied parameters and poorly prepared SQL queries. Attackers, without needing authentication, can insert additional SQL queries into existing ones. While the results are not visible to the attacker, an appropriately crafted payload may allow for the injection of malicious JavaScript, leading to Stored Cross-Site Scripting risks, thereby compromising the integrity of affected sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References