CVE-2024-12115
📋 TL;DR
This CSRF vulnerability in the Poll Maker WordPress plugin allows unauthenticated attackers to duplicate polls by tricking administrators into clicking malicious links. All WordPress sites using Poll Maker plugin versions up to 5.5.4 are affected. Attackers can create duplicate polls without proper authorization.
💻 Affected Systems
- Poll Maker – Versus Polls, Anonymous Polls, Image Polls WordPress plugin
📦 What is this software?
Poll Maker by Ays Pro
⚠️ Risk & Real-World Impact
Worst Case
Attackers could flood the site with duplicate polls, causing database bloat and potentially disrupting legitimate poll functionality. Repeated exploitation could degrade site performance.
Likely Case
Unauthorized poll duplication creating administrative confusion and poll data pollution. Attackers could create misleading or malicious polls.
If Mitigated
With proper CSRF protections and user awareness, impact is limited to minor administrative inconvenience.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators. No authentication required for the CSRF attack itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.5.5
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3202972/poll-maker/tags/5.5.5/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Poll Maker' plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 5.5.5+ from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDeactivate the Poll Maker plugin until patched
CSRF Protection via .htaccess
linuxAdd CSRF protection headers at web server level
Header set X-Frame-Options "SAMEORIGIN"
Header set Content-Security-Policy "frame-ancestors 'self'"
🧯 If You Can't Patch
- Implement strict SameSite cookie policies for admin sessions
- Educate administrators about phishing risks and require confirmation for poll management actions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Poll Maker version. If version is 5.5.4 or lower, system is vulnerable.Check Version:
wp plugin list --name='poll-maker' --field=versionVerify Fix Applied:
Verify plugin version is 5.5.5 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Multiple poll creation events from same admin session in short timeframe
- POST requests to /wp-admin/admin-ajax.php with action=duplicate_poll
Network Indicators:
- Cross-origin requests to poll duplication endpoints
- Referer header mismatches on admin actions
SIEM Query:
source="wordpress.log" AND "action=duplicate_poll" AND status=200 | stats count by src_ip, user_agent🔗 References
- https://plugins.trac.wordpress.org/changeset/3202972/poll-maker/tags/5.5.5/includes/lists/class-poll-maker-polls-list-table.php?old=3202972&old_path=poll-maker%2Ftags%2F5.5.4%2Fincludes%2Flists%2Fclass-poll-maker-polls-list-table.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e76447ec-2815-4758-ae2c-67a938a739d9?source=cve
