SQL Injection Vulnerability in Poll Maker's Versus Polls Plugin for WordPress
CVE-2024-9475

7.2HIGH

Key Information:

Vendor

Wordpress
Status
Poll Maker
Vendor
CVE Published:
26 October 2024

What is CVE-2024-9475?

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is susceptible to SQL Injection due to improper handling of the order_by parameter. This vulnerability affects all versions up to and including 5.4.6. Authenticated attackers with administrator-level access could exploit this weakness to inject malicious SQL code into the existing queries, potentially allowing them to retrieve sensitive data from the database. Proper parameter escaping and SQL query preparation are critical to prevent such vulnerabilities.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/poll-maker/tag...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2024-9475 : SQL Injection Vulnerability in Poll Maker's Versus Polls Plugin for WordPress