CVE-2024-6496: 
WordPress vulnerability analysis and mitigation

The Light Poll WordPress plugin through version 1.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2024-6496. The vulnerability was discovered by Vuln Seeker Cybersecurity Team and publicly disclosed on July 11, 2024. This security issue affects the poll deletion functionality in the plugin (WPScan).

The vulnerability stems from the absence of CSRF protection mechanisms when deleting polls within the Light Poll plugin. The CVSS v3.1 score is 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating that the vulnerability requires user interaction but can be exploited remotely without authentication (NIST NVD).

If successfully exploited, this vulnerability allows attackers to trick authenticated users into unknowingly deleting polls through CSRF attacks. This could lead to unauthorized deletion of poll data and potential disruption of website functionality (WPScan).

The vulnerability can be exploited by crafting a malicious request that triggers the poll deletion functionality. A proof of concept exists demonstrating the exploitation method using JavaScript: history.pushState('', '', '/'); document.forms[0].submit(); (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the Light Poll plugin should consider implementing additional security measures or temporarily disabling the poll deletion functionality until a patch is released (WPScan).