CVE-2024-6720: 
WordPress vulnerability analysis and mitigation

The Light Poll WordPress plugin through version 1.0.0 contains a Cross-Site Request Forgery (CSRF) vulnerability identified as CVE-2024-6720. The vulnerability was discovered by Vuln Seeker Cybersecurity Team and publicly disclosed on July 15, 2024. The issue stems from the absence of CSRF checks in certain plugin functionalities (WPScan).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue, identified as CWE-352. The CVSS v3.1 base score is 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability can be exploited through specific URLs targeting the poll settings page, particularly the answer removal functionality, using the pattern: https://example.com/wp-admin/admin.php?page=poll_settings&task=remove_answer&id=<ID>&answer_id=<ANSWER_ID> (WPScan).

When successfully exploited, this vulnerability allows attackers to make logged-in users perform unwanted actions via CSRF attacks, specifically enabling the unauthorized deletion of poll answers (NVD).

The vulnerability requires user interaction and can be exploited through crafted URLs that target the poll answer deletion functionality. No authentication is required to initiate the attack, though it relies on the target being logged into the WordPress admin interface (WPScan).

Currently, there is no known fix available for this vulnerability. Users of the Light Poll WordPress plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch is released (WPScan).