CVE-2024-12115 Overview
The Poll Maker plugin for WordPress, developed by ays-pro, contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 5.5.4. The flaw resides in the duplicate_poll() function, which lacks proper nonce validation. Unauthenticated attackers can craft a forged request that duplicates polls when a site administrator is tricked into clicking a malicious link. The vulnerability is tracked under CWE-352 and affects the free WordPress distribution of the plugin.
Critical Impact
Attackers can duplicate polls on vulnerable WordPress sites by tricking administrators into clicking crafted links, impacting content integrity on affected installations.
Affected Products
- Ays-pro Poll Maker plugin for WordPress (all versions through 5.5.4)
- WordPress sites running the free distribution of Poll Maker
- Component: ays-pro:poll_maker
Discovery Timeline
- 2024-12-07 - CVE-2024-12115 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12115
Vulnerability Analysis
The vulnerability is a Cross-Site Request Forgery weakness in the Poll Maker WordPress plugin. The duplicate_poll() function processes requests to duplicate existing polls without verifying a valid WordPress nonce token. This absence of state-changing request validation allows an off-site attacker to craft HTML or JavaScript that triggers the duplication action using an authenticated administrator's session cookies.
Successful exploitation requires user interaction, specifically that a logged-in administrator visits an attacker-controlled page or clicks a crafted link. The resulting impact is limited to integrity, since the attacker can only cause poll duplication rather than data disclosure or service disruption. Confidentiality and availability are not directly affected.
Root Cause
The root cause is missing or incorrect nonce validation in the duplicate_poll() function within includes/lists/class-poll-maker-polls-list-table.php. WordPress nonces are tokens designed to validate the origin and intent of state-changing requests. Without wp_verify_nonce() or check_admin_referer() checks, the plugin trusts any incoming request bearing valid administrator session cookies, regardless of its origin.
Attack Vector
An attacker hosts a malicious page containing a forged request targeting the vulnerable duplication endpoint. The attacker then delivers the link to a WordPress administrator via phishing, social engineering, or embedded content. When the administrator visits the page while authenticated to the target WordPress site, the browser automatically includes session cookies with the forged request. The duplicate action executes under administrator context, creating unauthorized copies of polls on the site.
See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2024-12115
Indicators of Compromise
- Unexpected duplicate poll entries appearing in the WordPress admin Poll Maker list
- HTTP referer headers pointing to external domains for requests invoking poll duplication actions
- Administrator browser history showing visits to unfamiliar sites immediately before poll duplication events
Detection Strategies
- Monitor WordPress database tables used by Poll Maker for unexpected INSERT operations correlated with administrator sessions
- Review web server access logs for requests to the plugin's admin action handlers that lack valid _wpnonce parameters
- Audit the installed version of the Poll Maker plugin and flag any instance at or below 5.5.4
Monitoring Recommendations
- Enable WordPress administrative action logging through a security plugin to capture poll creation and duplication events
- Alert on anomalous bursts of poll duplication within short time windows from a single administrator session
- Track plugin update status via centralized WordPress management tooling to confirm patched versions are deployed
How to Mitigate CVE-2024-12115
Immediate Actions Required
- Update the Poll Maker plugin to version 5.5.5 or later, which adds proper nonce validation to the duplicate_poll() function
- Review existing polls for unauthorized duplicates and remove any that are not legitimate
- Instruct administrators to log out of WordPress when not actively managing the site to reduce CSRF exposure
Patch Information
The vendor addressed the vulnerability in Poll Maker version 5.5.5. The fix is documented in the WordPress Plugin Change Log, which shows the updated handling in class-poll-maker-polls-list-table.php.
Workarounds
- Deactivate the Poll Maker plugin until the patched version can be installed
- Restrict access to the WordPress admin interface by IP allowlist at the web server or firewall layer
- Deploy a web application firewall rule that requires a valid _wpnonce parameter on poll duplication requests
- Train administrators to avoid clicking untrusted links while authenticated to the WordPress admin panel
# Example WordPress CLI command to update the plugin
wp plugin update poll-maker --version=5.5.5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
