CVE-2024-9022 Overview
CVE-2024-9022 is a SQL Injection vulnerability [CWE-89] in the TS Poll – Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress. The flaw affects all versions up to and including 2.4.0. The plugin fails to escape the user-supplied orderby parameter and does not sufficiently prepare the underlying SQL query. Authenticated attackers with Administrator-level access or higher can append additional SQL statements to existing queries and extract sensitive data from the WordPress database.
Critical Impact
Authenticated administrators can execute arbitrary SQL statements against the WordPress database, exposing user credentials, session tokens, and site configuration data.
Affected Products
- Total-soft TS Poll plugin for WordPress versions <= 2.4.0
- WordPress sites running the poll-wp plugin (Survey, Versus Poll, Image Poll, Video Poll)
- Administrative interfaces exposing the class-ts_poll_list.php component
Discovery Timeline
- 2024-10-10 - CVE-2024-9022 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-9022
Vulnerability Analysis
The vulnerability resides in the administrative poll listing functionality implemented in class-ts_poll_list.php. The plugin accepts the orderby HTTP parameter and concatenates its value directly into a SQL query used to sort poll records. Because the parameter is neither escaped nor bound through a prepared statement, an attacker can inject arbitrary SQL syntax into the ORDER BY clause. Exploitation requires authentication at Administrator privilege or higher, which limits the attack surface to compromised admin accounts, malicious insiders, or multi-tenant WordPress deployments where lower-trust admins exist.
Root Cause
The root cause is insufficient input sanitization combined with the absence of parameterized queries. ORDER BY clauses cannot be parameterized with standard $wpdb->prepare() placeholders, so developers must explicitly validate the column and direction values against an allow-list. The affected version did neither, allowing tainted input to reach the query string. The vendor addressed the flaw in the change committed to the 2.4.1 release, visible in the WordPress Poll Plugin Update Log.
Attack Vector
An authenticated administrator submits a crafted request to the plugin's admin listing page with a malicious orderby value. The injected payload can use UNION-based, error-based, or time-based techniques to enumerate database schemas and exfiltrate rows from wp_users, wp_usermeta, and wp_options. Public proof-of-concept material is available in the GitHub PoC Repository and the Packet Storm SQL Injection Advisory.
No verified code example is included here. Refer to the Wordfence Vulnerability Report for exploitation details.
Detection Methods for CVE-2024-9022
Indicators of Compromise
- HTTP requests to WordPress admin endpoints containing orderby values with SQL keywords such as UNION, SELECT, SLEEP(, or information_schema.
- Unusual ORDER BY clauses in MySQL slow-query or general-query logs originating from the wp-admin context.
- Unexpected reads against wp_users, wp_usermeta, or wp_options from the WordPress database user.
- Presence of the vulnerable class-ts_poll_list.php file at plugin version <= 2.4.0.
Detection Strategies
- Monitor web access logs for administrator sessions issuing polling-related admin requests with encoded SQL metacharacters in orderby.
- Deploy WordPress-aware WAF signatures that inspect the orderby parameter for non-alphanumeric values.
- Correlate administrator authentication events with subsequent anomalous database query patterns.
Monitoring Recommendations
- Enable MySQL general query logging on WordPress database instances that host the TS Poll plugin.
- Alert on administrator accounts performing unusual data reads outside expected working hours.
- Track plugin version inventory across WordPress deployments and flag installations at <= 2.4.0.
How to Mitigate CVE-2024-9022
Immediate Actions Required
- Upgrade the TS Poll plugin to version 2.4.1 or later on all affected WordPress sites.
- Audit WordPress administrator accounts and remove or disable unused privileged users.
- Rotate database credentials and WordPress secret keys if administrator compromise is suspected.
- Review recent poll admin activity for signs of tampering with the orderby parameter.
Patch Information
The vendor released version 2.4.1 of the poll-wp plugin, which corrects the sanitization of the orderby parameter in class-ts_poll_list.php. The relevant commit is documented in the WordPress Poll Plugin Change Log and the follow-up Update Log. Additional vendor information is available on the Total Soft Poll Plugin Overview page.
Workarounds
- Deactivate and remove the TS Poll plugin until the site can be upgraded to 2.4.1.
- Restrict access to WordPress administrator endpoints using IP allow-listing or VPN gating.
- Enforce multi-factor authentication on all WordPress administrator accounts to reduce the risk of credential-based abuse.
- Deploy a WordPress security plugin or WAF rule that blocks non-whitelisted values in the orderby parameter.
# Example WP-CLI commands to inventory and upgrade the plugin
wp plugin get poll-wp --field=version
wp plugin update poll-wp --version=2.4.1
wp plugin deactivate poll-wp # temporary workaround if patching is delayed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
