CVE-2024-9022
📋 TL;DR
This SQL injection vulnerability in the TS Poll WordPress plugin allows authenticated attackers with Administrator-level access to execute arbitrary SQL queries. Attackers can extract sensitive information from the database, including user credentials and other confidential data. All WordPress sites using vulnerable versions of this plugin are affected.
💻 Affected Systems
- TS Poll – Survey, Versus Poll, Image Poll, Video Poll WordPress plugin
📦 What is this software?
Ts Poll by Total Soft
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to credential theft, data exfiltration, privilege escalation, and potential site takeover.
Likely Case
Extraction of sensitive data including user information, passwords, and other confidential database contents.
If Mitigated
Limited impact if proper access controls and input validation are in place, though SQL injection would still be possible.
🎯 Exploit Status
Exploitation requires Administrator credentials but is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.0 or later
Vendor Advisory: https://total-soft.com/wp-poll/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'TS Poll' plugin
4. Click 'Update Now' if update is available
5. Alternatively, download version 2.4.0+ from WordPress repository and manually update
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the TS Poll plugin until patched
wp plugin deactivate poll-wp
Web Application Firewall rule
allBlock SQL injection attempts targeting the orderby parameter
🧯 If You Can't Patch
- Remove Administrator access from untrusted users
- Implement strict input validation and parameterized queries at application level
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for TS Poll version ≤2.3.9Check Version:
wp plugin get poll-wp --field=versionVerify Fix Applied:
Verify plugin version is 2.4.0 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by successful Administrator login
- Suspicious orderby parameter values in web server logs
Network Indicators:
- SQL injection patterns in HTTP requests to poll-related endpoints
SIEM Query:
source="web_server" AND ("orderby" AND ("UNION" OR "SELECT" OR "FROM" OR "WHERE"))🔗 References
- https://github.com/capture0x/Poll-Plugin-SQL-Injection-
- https://packetstormsecurity.com/files/179414/WordPress-Poll-2.3.6-SQL-Injection.html
- https://total-soft.com/wp-poll/
- https://wordpress.org/plugins/poll-wp/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d16363d6-ca4b-4de0-abae-a7b07803e2e3?source=cve
