SQL Injection Vulnerability in Poll Maker's Versus Polls Plugin for WordPress
CVE-2024-9475

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
Poll Maker – Versus Polls, Anonymous Polls, Image Polls
Vendor
CVE Published:
26 October 2024

What is CVE-2024-9475?

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is susceptible to SQL Injection due to improper handling of the order_by parameter. This vulnerability affects all versions up to and including 5.4.6. Authenticated attackers with administrator-level access could exploit this weakness to inject malicious SQL code into the existing queries, potentially allowing them to retrieve sensitive data from the database. Proper parameter escaping and SQL query preparation are critical to prevent such vulnerabilities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Poll Maker – Versus Polls, Anonymous Polls, Image Polls * <= 5.4.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/poll-maker/tag...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.