SQL Injection Vulnerability in Poll Maker's Versus Polls Plugin for WordPress
CVE-2024-9475
7.2HIGH
What is CVE-2024-9475?
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is susceptible to SQL Injection due to improper handling of the order_by parameter. This vulnerability affects all versions up to and including 5.4.6. Authenticated attackers with administrator-level access could exploit this weakness to inject malicious SQL code into the existing queries, potentially allowing them to retrieve sensitive data from the database. Proper parameter escaping and SQL query preparation are critical to prevent such vulnerabilities.