CVE-2021-24651: Poll Maker < 3.4.2 - Unauthenticated Time Based SQL Injection
The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the aysfinishpoll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-24651?
CVE-2021-24651 is a vulnerability in the Poll Maker WordPress plugin before version 3.4.2 that allows unauthenticated users to perform SQL injection.
How does CVE-2021-24651 affect the Poll Maker WordPress plugin?
CVE-2021-24651 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action in the Poll Maker WordPress plugin.
What is the severity of CVE-2021-24651?
CVE-2021-24651 has a severity rating of 7.5 out of 10, indicating a high severity.
How can an attacker exploit CVE-2021-24651?
An attacker can exploit CVE-2021-24651 by performing SQL injection attacks using the ays_finish_poll AJAX action to exfiltrate data, such as password hashes, through a timing attack.
Is there a fix available for CVE-2021-24651?
Yes, a fix for CVE-2021-24651 is available in version 3.4.2 of the Poll Maker WordPress plugin.