CVE-2021-24483
📋 TL;DR
This SQL injection vulnerability in the Poll Maker WordPress plugin allows authenticated attackers with admin dashboard access to execute arbitrary SQL commands. It affects WordPress sites running vulnerable plugin versions, potentially compromising database integrity and confidentiality.
💻 Affected Systems
- Poll Maker WordPress Plugin
📦 What is this software?
Poll Maker by Ays Pro
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, modification, or deletion; potential privilege escalation to full site control.
Likely Case
Unauthorized data access, extraction of sensitive information from database tables, potential for data manipulation.
If Mitigated
Limited impact with proper input validation and parameterized queries preventing SQL injection.
🎯 Exploit Status
Exploitation requires authenticated admin access; SQL injection via orderby parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.1
Vendor Advisory: https://wpscan.com/vulnerability/0dc931c6-1fce-4d70-a658-a4bbab10dab3
Restart Required: No
Instructions:
1. Log into WordPress admin dashboard. 2. Navigate to Plugins → Installed Plugins. 3. Find Poll Maker plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 3.2.1+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation for orderby parameter in affected functions
Modify plugin files to sanitize orderby parameter before SQL queries
Temporary Disable
linuxDisable vulnerable plugin until patched
wp plugin deactivate poll-maker
🧯 If You Can't Patch
- Restrict admin dashboard access to trusted users only
- Implement web application firewall with SQL injection rules
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin → Plugins → Poll MakerCheck Version:
wp plugin get poll-maker --field=versionVerify Fix Applied:
Confirm plugin version is 3.2.1 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin dashboard
Network Indicators:
- Suspicious POST requests to admin-ajax.php with SQL-like parameters
SIEM Query:
source="wordpress.log" AND "orderby" AND ("UNION" OR "SELECT" OR "FROM")