CVE-2020-11673: Critical severity total-soft responsive poll vulnerability
Published Apr 13, 2020
·Updated
An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view a hidden poll. This is due to the usage of the callback wpajaxnopriv function in Includes/Total-Soft-Poll-Ajax.php for sensitive operations.
Affected Software
1 affected component
Total-Soft Responsive Poll Wordpress<=1.3.4
Event History
Apr 13, 2020
CVE Published
via MITRE·03:01 PM
Data Sourced
via MITRE·03:01 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue with the Responsive Poll plugin for WordPress?
The vulnerability ID for this issue is CVE-2020-11673.
2
What is the severity of CVE-2020-11673?
The severity of CVE-2020-11673 is critical with a CVSS score of 9.8.
3
What is the affected software?
The affected software is the Total-soft Responsive Poll plugin for WordPress version 1.3.4 and below.
4
What can an unauthenticated user do with this vulnerability?
An unauthenticated user can manipulate polls, such as deleting, cloning, or viewing hidden polls.
5
How can I fix the vulnerability in the Responsive Poll plugin for WordPress?
To fix the vulnerability, update the Total-soft Responsive Poll plugin to a version higher than 1.3.4.