CVE-2020-24315: 
WordPress vulnerability analysis and mitigation

The Vinoj Cardoza WordPress Poll Plugin version 36 and earlier contains a SQL injection vulnerability (CVE-2020-24315) that was disclosed on August 26, 2020. The vulnerability affects the pollid POST parameter due to insufficient input validation, allowing attackers to execute arbitrary SQL statements. The plugin has been closed since June 23, 2020, due to this security issue (NVD, WordPress).

The vulnerability stems from improper neutralization of special elements used in SQL commands (CWE-89). The issue received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability allows unauthenticated attackers to execute arbitrary SQL statements through the pollid POST parameter due to lack of proper input escaping (NVD).

When exploited, this vulnerability allows attackers to dump the entire target's database, potentially exposing sensitive information stored within the WordPress installation. The high confidentiality impact rating indicates significant potential for unauthorized access to sensitive data (NVD).

The vulnerability is easily exploitable, requiring no authentication or user interaction. An attacker only needs the ability to send crafted SQL statements via the pollid POST parameter to successfully exploit the vulnerability (NVD).

The plugin has been closed and is no longer available for download from the WordPress plugin repository since June 23, 2020. Users should immediately remove this plugin from their WordPress installations and seek alternative polling solutions (WordPress).