CVE-2025-12620: 
WordPress vulnerability analysis and mitigation

CVE-2025-12620 affects the Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress in versions up to and including 6.0.7. The vulnerability is a SQL Injection issue that exists in the 'filterbyauthor' parameter due to insufficient escaping and preparation of SQL queries. This vulnerability was discovered and reported by Wordfence on November 13, 2025 (NVD Database).

The vulnerability is classified as a SQL Injection (CWE-89) with a CVSS v3.1 Base Score of 4.9 (MEDIUM), and vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. The issue stems from insufficient escaping on the user-supplied 'filterbyauthor' parameter and lack of proper SQL query preparation (Wordfence).

The vulnerability allows authenticated attackers with Administrator-level access to append additional SQL queries to existing queries, potentially leading to the extraction of sensitive information from the database (NVD Database).

Users should update the Poll Maker plugin to a version newer than 6.0.7 once available. In the meantime, it is recommended to restrict administrator access only to trusted users and monitor for suspicious database queries (NVD Database).