SQL Injection Vulnerability in Pollin Plugin for WordPress

CVE-2024-13712

What is CVE-2024-13712?

The Pollin plugin for WordPress contains a vulnerability that allows SQL Injection through the 'question' parameter. This issue arises from inadequate input escaping and improper query preparation, enabling unauthenticated attackers to inject malicious SQL statements. Such injections can lead to unauthorized access and the potential exposure of sensitive information stored in the database. Users of versions up to and including 1.01.1 should take immediate action to secure their installations.

References