The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Basic Information Exposure in all versions up to, and including, 5.8.9 via the ‘ays_finish_poll’ AJAX action. This vulnerability allows unauthenticated attackers to retrieve admin email information exposed in the poll response.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2024-12575 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted AJAX request to the ‘ays_finish_poll’ action without authentication. This request can retrieve sensitive admin email information from the poll response, allowing the attacker to gain unauthorized access to this data.
Affected Products
- Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress (versions up to 5.8.9 are affected by this vulnerability).
Mitigation
To mitigate this vulnerability, users should update the Poll Maker plugin to version 5.9.0 or later, which addresses the information exposure issue. Regularly updating plugins and monitoring for security advisories can help prevent similar vulnerabilities.