CVE-2024-6496
📋 TL;DR
The Light Poll WordPress plugin through version 1.0.0 lacks Cross-Site Request Forgery (CSRF) protection when deleting polls. This allows attackers to trick authenticated administrators into unintentionally deleting polls via malicious links or scripts. WordPress sites using this vulnerable plugin are affected.
💻 Affected Systems
- Light Poll WordPress Plugin
📦 What is this software?
Light Poll by Dmytropopov
⚠️ Risk & Real-World Impact
Worst Case
An attacker could systematically delete all polls on a WordPress site, causing data loss and disrupting user engagement features.
Likely Case
Attackers would delete polls to vandalize sites or disrupt poll-based functionality, requiring administrators to restore from backups.
If Mitigated
With proper CSRF protections implemented, no unauthorized poll deletions would occur.
🎯 Exploit Status
Exploitation requires tricking an authenticated admin into clicking a malicious link or visiting a compromised page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.1 or later
Vendor Advisory: https://wpscan.com/vulnerability/d598eabd-a87a-4e3e-be46-a5c5cc3f130e/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Light Poll plugin. 4. Click 'Update Now' if update available. 5. If no update, deactivate and delete plugin, then install latest version from WordPress repository.
🔧 Temporary Workarounds
Deactivate Plugin
allTemporarily disable the Light Poll plugin to prevent exploitation.
wp plugin deactivate light-poll
🧯 If You Can't Patch
- Restrict admin access to trusted networks only.
- Implement web application firewall rules to block CSRF attempts.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Light Poll version 1.0.0 or earlier.Check Version:
wp plugin get light-poll --field=versionVerify Fix Applied:
Verify Light Poll plugin is updated to version 1.0.1 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unexpected poll deletion events in WordPress logs.
- Multiple DELETE requests to poll endpoints from unusual sources.
Network Indicators:
- HTTP POST requests to poll deletion endpoints without proper referrer headers.
SIEM Query:
source="wordpress.log" AND "poll" AND "deleted" AND NOT user="admin"