CVE-2025-12620: 
WordPress vulnerability analysis and mitigation

CVE-2025-12620 is a SQL Injection vulnerability in the Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress, affecting all versions up to and including 6.0.7. The flaw exists in the filterbyauthor parameter due to insufficient input escaping and lack of proper SQL query preparation. It was disclosed on November 13, 2025, by Wordfence, and carries a CVSS v3.1 base score of 4.9 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The root cause is insufficient escaping of the user-supplied filterbyauthor parameter combined with inadequate preparation of the existing SQL query in the plugin's poll list table class (class-poll-maker-polls-list-table.php, lines 2033 and 2053). An authenticated attacker with Administrator-level privileges can append additional SQL statements to the existing query to extract sensitive data from the WordPress database (Wordfence, Plugin Source).

Successful exploitation allows an authenticated administrator-level attacker to extract sensitive information from the WordPress database, including user credentials, personal data, and site configuration. The impact is limited to confidentiality — integrity and availability are not directly affected by this vulnerability. Because exploitation requires Administrator-level access, the practical risk is somewhat constrained, though it could be leveraged in scenarios involving compromised admin accounts or multi-tenant environments (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-12620. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.023%, indicating a very low probability of exploitation in the near term. Exploitation requires authenticated Administrator-level access, which significantly limits the attacker pool (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Poll Maker plugin version 6.0.7 or earlier using tools like WPScan or by inspecting plugin metadata in publicly accessible WordPress installations.
2. Authentication: Obtain or compromise an Administrator-level WordPress account on the target site.
3. Access the vulnerable endpoint: Navigate to the WordPress admin panel and access the poll management list table, which processes the filterbyauthor parameter.
4. Inject malicious SQL payload: Craft a request that includes a SQL injection payload in the filterbyauthor parameter (e.g., appending UNION SELECT statements or boolean-based blind injection techniques) to manipulate the underlying SQL query.
5. Extract sensitive data: Retrieve database contents such as WordPress user table entries (usernames, hashed passwords, emails) or other sensitive site data from the query response (Wordfence, Plugin Source).

• Logs: WordPress access logs showing unusual or malformed requests to admin-side poll management pages with SQL syntax characters (e.g., UNION, SELECT, --, ') in the filterbyauthor parameter.
• Database: Unexpected or anomalous database query patterns in MySQL slow query logs or general query logs involving the poll-maker plugin tables.
• Network: Repeated admin-panel requests from unusual IP addresses or at unusual times targeting poll list endpoints.

Users should update the Poll Maker plugin to a version beyond 6.0.7 that addresses this SQL injection vulnerability. As an interim measure, administrators should restrict access to the WordPress admin panel using IP allowlisting or two-factor authentication to reduce the risk of compromised admin accounts being exploited. Monitoring WordPress admin activity logs for anomalous behavior is also recommended (Wordfence).

Wordfence disclosed this vulnerability as part of their weekly WordPress vulnerability report for November 10–16, 2025, noting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the initial Wordfence disclosure has been identified.