CVE-2021-24651
High
Description
The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Ays-pro Poll Maker
PublishedOct 11, 2021
First seenOct 11, 2021
Weakness typeCWE-89SQL injectionCWE-203CWE-203
How to fix
Update
- ays-pro poll_maker3.4.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ays-pro poll_maker | v < 3.4.2 | 3.4.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.