CVE-2021-24442
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform SQL injection attacks on WordPress sites using the WPDevArt Polls plugin. Attackers can manipulate database queries by sending specially crafted POST parameters. All WordPress sites running vulnerable versions of this plugin are affected.
💻 Affected Systems
- WPDevArt Polls, Survey, Questionnaire and Voting system WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, privilege escalation, and potential remote code execution through database functions.
Likely Case
Data exfiltration from the WordPress database including user credentials, sensitive content, and potentially gaining administrative access.
If Mitigated
Limited impact with proper input validation and database user privilege restrictions in place.
🎯 Exploit Status
Exploitation requires sending POST requests to the vulnerable endpoint with SQL injection payloads in the date_answers[] parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.3
Vendor Advisory: https://wordpress.org/plugins/poll-wd/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find 'Poll, Survey, Questionnaire and Voting system'. 4. Click 'Update Now' or manually update to version 1.5.3 or later.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the WPDevArt Polls plugin until patched
wp plugin deactivate poll-wd
Web Application Firewall rule
linuxBlock requests containing SQL injection patterns targeting date_answers[] parameter
ModSecurity rule: SecRule ARGS_POST:date_answers "@detectSQLi" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Implement strict input validation for all POST parameters in custom code
- Restrict database user privileges to minimum required permissions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Poll, Survey, Questionnaire and Voting system. If version is below 1.5.3, you are vulnerable.Check Version:
wp plugin get poll-wd --field=versionVerify Fix Applied:
Verify plugin version is 1.5.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-admin/admin-ajax.php with date_answers[] parameter containing SQL keywords
- Unusual database query patterns in WordPress or MySQL logs
Network Indicators:
- HTTP POST requests with SQL injection payloads in parameters
- Unusual database connection attempts from web server
SIEM Query:
source="web_logs" AND uri="/wp-admin/admin-ajax.php" AND (param="date_answers" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR 1=1")