1. Home
  2. CVE Database
  3. CVE-2021-24651
HIGH · 7.5

CVE-2021-24651

The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possibl...

Vulnerability Description

The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Ays-ProPoll Maker< 3.4.2

Related Weaknesses (CWE)

CWE-89CWE-203

References

FAQ

What is CVE-2021-24651?

CVE-2021-24651 is a vulnerability with a CVSS score of 7.5 (HIGH). The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possibl...

How severe is CVE-2021-24651?

CVE-2021-24651 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24651?

Check the references section above for vendor advisories and patch information. Affected products include: Ays-Pro Poll Maker.