CVE-2021-24483: 
WordPress vulnerability analysis and mitigation

The Poll Maker WordPress plugin before version 3.2.1 contained multiple SQL injection vulnerabilities in its admin dashboard functionality. The vulnerability was assigned CVE-2021-24483 and was discovered by To Quang Duong. The issue was publicly disclosed on June 29, 2021 and received a CVSS score of 7.6 (High) (WPScan).

The vulnerability existed in the getpollcategories(), getpolls() and getreports() functions which failed to properly validate or whitelist the 'orderby' parameter before using it in SQL statements passed to the get_results() DB calls. This allowed for SQL injection attacks through the admin dashboard. The vulnerability was confirmed to affect MySQL databases version 8.0.0 and above running on Linux Ubuntu 20.04/19.10 systems with Apache 2.4.41 (WPScan).

The vulnerability allows authenticated users with high privileges to perform SQL injection attacks through the admin dashboard. While requiring authentication limits the scope, successful exploitation could allow attackers to manipulate or extract data from the underlying database (WPScan).

The vulnerability was fixed in Poll Maker version 3.2.1. Users should upgrade to this version or later to remediate the issue (WPScan).