Security readout for executives and security teams
Plain-English summary
This vulnerability affects the Poll Maker WordPress plugin before 3.2.1. An authenticated user in the admin dashboard could influence database query sorting parameters in ways that create blind SQL injection risk, potentially exposing or altering site data depending on privileges and database access.
Executive priority
Prioritize remediation for public WordPress sites with multiple admin users, shared credentials, or third-party access. This is not KEV-backed active exploitation, but SQL injection in a CMS plugin can create meaningful data risk.
Technical view
The plugin functions get_poll_categories(), get_polls(), and get_reports() failed to whitelist or validate the orderby parameter before passing SQL to get_results(). The issue is CWE-89 SQL injection and is described as authenticated blind SQL injection in the admin dashboard.
Likely exposure
Exposure is likely limited to WordPress sites running Poll Maker before 3.2.1 where an attacker has authenticated access to the relevant admin dashboard functionality. The source bundle does not define the exact required WordPress role or capability.
Exploitation context
The source bundle does not report active exploitation, and the CVE is not listed as KEV. Treat exploitation as plausible for vulnerable authenticated admin surfaces, but do not assume internet-wide exploitation from the provided evidence.
Researcher notes
Key uncertainty is the exact authenticated privilege required. Source evidence identifies vulnerable functions and the unsafe orderby parameter, but does not provide CVSS, exploit maturity, or detailed role requirements in the supplied bundle.
Mitigation direction
- Update Poll Maker to 3.2.1 or later after confirming vendor guidance.
- Remove or disable Poll Maker if it is unused.
- Restrict WordPress admin access to trusted accounts only.
- Review accounts with poll management or dashboard access.
- Monitor database and admin logs for suspicious poll-related activity.
Validation and detection
- Inventory WordPress sites using the Poll Maker plugin.
- Confirm the installed Poll Maker version on each site.
- Identify users with access to Poll Maker admin dashboard functions.
- Check vendor or WPScan guidance for fixed-version confirmation.
- Review recent admin activity around polls, categories, and reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-24483 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://wpscan.com/vulnerability/0dc931c6-1fce-4d70-a658-a4bbab10dab3CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.