CVE-2024-32514
📋 TL;DR
This vulnerability allows authenticated attackers to upload arbitrary files, including malicious scripts, to WordPress sites running the vulnerable WP Poll Maker plugin. Attackers can achieve remote code execution and compromise the entire website. All WordPress sites using WP Poll Maker versions up to 3.4 are affected.
💻 Affected Systems
- WordPress WP Poll Maker plugin by Poll Maker & Voting Plugin Team (InfoTheme)
📦 What is this software?
Wp Poll Maker by Infotheme
⚠️ Risk & Real-World Impact
Worst Case
Complete website takeover, data theft, malware distribution, and server compromise leading to lateral movement within the network.
Likely Case
Website defacement, backdoor installation, credential theft, and use as a malware distribution platform.
If Mitigated
Limited impact if file uploads are restricted via web application firewall or server-side controls.
🎯 Exploit Status
Exploitation requires authenticated access but is trivial once authenticated. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/epoll-wp-voting/wordpress-wp-poll-maker-plugin-3-4-authenticated-arbitrary-file-upload-vulnerability
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP Poll Maker and click 'Update Now'. 4. Verify version is 3.5 or higher.
🔧 Temporary Workarounds
Disable plugin
allTemporarily disable the WP Poll Maker plugin until patching is possible.
wp plugin deactivate wp-poll-maker
Restrict file uploads via .htaccess
linuxBlock execution of uploaded files in the uploads directory.
<FilesMatch "\.(php|php5|php7|phtml|phar)$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Remove authenticated user access for all non-administrative roles
- Implement web application firewall rules to block file uploads to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → WP Poll Maker → Version. If version is 3.4 or lower, you are vulnerable.Check Version:
wp plugin get wp-poll-maker --field=versionVerify Fix Applied:
After updating, verify version shows 3.5 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to /wp-content/uploads/wp-poll-maker/
- POST requests to /wp-admin/admin-ajax.php with action=ays_poll_upload_file
Network Indicators:
- Unexpected outbound connections from web server after file uploads
- HTTP requests to known malicious domains from web server
SIEM Query:
source="web_access.log" AND (uri="/wp-admin/admin-ajax.php" AND post_data="action=ays_poll_upload_file")🔗 References
- https://patchstack.com/database/vulnerability/epoll-wp-voting/wordpress-wp-poll-maker-plugin-3-4-authenticated-arbitrary-file-upload-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/epoll-wp-voting/wordpress-wp-poll-maker-plugin-3-4-authenticated-arbitrary-file-upload-vulnerability?_s_id=cve
