CVE-2024-9874: Ays-pro Poll Maker SQL Injection Flaw

CVE-2024-9874 Overview

CVE-2024-9874 is a time-based SQL Injection vulnerability affecting the Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress. The flaw resides in the handling of the orderby parameter and impacts all plugin versions up to and including 5.4.6. Insufficient escaping of user-supplied input and inadequate query preparation allow authenticated attackers with Administrator-level access to append arbitrary SQL to existing queries. Successful exploitation enables extraction of sensitive information from the underlying database, including user data, credentials, and site configuration values. The vulnerability is tracked under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated administrators can execute arbitrary SQL statements through the vulnerable orderby parameter, exposing all data stored in the WordPress database.

Affected Products

Ays-pro Poll Maker plugin for WordPress (free edition)
All versions up to and including 5.4.6
WordPress sites where the plugin is installed and active

Discovery Timeline

2024-11-09 - CVE-2024-9874 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9874

Vulnerability Analysis

The Poll Maker plugin exposes administrative list tables that accept an orderby request parameter to sort poll results. The plugin passes this parameter into a SQL query that constructs the ORDER BY clause without proper sanitization or use of prepared statements. Because ORDER BY clauses cannot be parameterized through standard placeholder binding, developers must explicitly validate this input against an allowlist. The plugin fails to do so, so attacker-controlled content flows directly into the query.

The injection is time-based, meaning attackers use SQL constructs such as SLEEP() or BENCHMARK() to infer data by measuring server response delay. This technique allows blind extraction of database contents even when query output is not reflected in the response.

Root Cause

The root cause is missing input escaping combined with unprepared SQL concatenation in the plugin's results list table code paths. Reference implementations of the vulnerable logic exist in class-poll-maker-results-list-table.php line 58 and class-poll-maker-each-results-poll-list-table.php line 48. Both locations construct queries by concatenating the raw orderby value rather than validating it against a fixed set of column names.

Attack Vector

Exploitation requires network access to the WordPress admin dashboard and authenticated Administrator privileges. An attacker submits a crafted request to a Poll Maker admin page containing a malicious orderby parameter value. The payload injects additional SQL clauses that trigger measurable delays based on conditional expressions against target rows. Public exploitation details have been published on Packet Storm referencing version 5.3.2. See the Wordfence advisory for additional exploitation context.

// Vulnerability described in prose only — no verified PoC code is included.
// See the referenced advisories for technical details.

Detection Methods for CVE-2024-9874

Indicators of Compromise

HTTP requests to WordPress admin pages containing orderby parameter values with SQL keywords such as SLEEP, BENCHMARK, SELECT, UNION, or CASE WHEN
Abnormally long response times on admin endpoints tied to the Poll Maker plugin
Unexpected outbound queries or table reads originating from the WordPress database user during administrator sessions
Web server access logs showing repeated Poll Maker admin URL access from a single administrator account within a short window

Detection Strategies

Deploy WordPress-aware web application firewall rules that block SQL metacharacters and time-delay functions in the orderby parameter
Enable MySQL general query logging or slow query logging to capture injected SLEEP() or BENCHMARK() calls
Monitor administrator session activity for anomalous request patterns to admin.php pages associated with the plugin
Correlate WordPress audit logs with database query telemetry to identify authenticated administrators triggering non-standard queries

Monitoring Recommendations

Track the installed version of the Poll Maker plugin across all WordPress instances and alert on versions at or below 5.4.6
Alert on any HTTP request where the orderby value contains characters outside [A-Za-z0-9_]
Baseline normal database query latency for admin actions and generate alerts on statistical outliers
Review administrator account creation and privilege changes for accounts recently added to WordPress sites running the plugin

How to Mitigate CVE-2024-9874

Immediate Actions Required

Update the Poll Maker plugin to a version newer than 5.4.6 on all WordPress installations
Audit WordPress administrator accounts and remove or rotate credentials for any account not required for daily operations
Enforce multi-factor authentication for all WordPress administrator accounts to reduce the risk of credential-based compromise
If the plugin is not actively used, deactivate and remove it entirely

Patch Information

The vendor addressed the vulnerability in versions released after 5.4.6. Review the patched code in the WordPress plugin repository and the Wordfence vulnerability record for fix details. Apply the update through the WordPress admin plugin manager or via WP-CLI.

Workarounds

Restrict WordPress admin dashboard access to trusted IP ranges via web server or reverse proxy rules
Deploy a WAF rule that rejects requests where orderby contains characters other than alphanumerics and underscores
Apply the principle of least privilege by limiting the number of accounts holding the Administrator role
Disable the plugin until the update has been applied and verified

bash

# Update the Poll Maker plugin using WP-CLI
wp plugin update poll-maker

# Verify the installed version is above 5.4.6
wp plugin get poll-maker --field=version

# Deactivate the plugin if an update cannot be applied immediately
wp plugin deactivate poll-maker