CVE-2025-12620 Overview
CVE-2025-12620 is a SQL injection vulnerability in the Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress. The flaw affects all versions up to and including 6.0.7. The plugin fails to properly escape the filterbyauthor parameter and does not adequately prepare the resulting SQL query. Authenticated attackers with Administrator-level access or above can append additional SQL statements to extract sensitive data from the WordPress database. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Administrator-level attackers can execute arbitrary SQL queries against the WordPress database, exposing user credentials, session tokens, and other sensitive site data.
Affected Products
- Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress
- All versions up to and including 6.0.7
- WordPress sites where the plugin is installed and active
Discovery Timeline
- 2025-11-13 - CVE-2025-12620 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12620
Vulnerability Analysis
The vulnerability resides in the polls list table implementation, specifically in class-poll-maker-polls-list-table.php at lines 2033 and 2053. The plugin accepts the filterbyauthor request parameter and incorporates it into a SQL query without sufficient sanitization or parameterized query binding. As a result, attacker-supplied input breaks out of the intended query context and executes as SQL syntax.
Exploitation requires an authenticated session with Administrator privileges or higher, which limits the attack surface to insider threats, compromised admin accounts, or multi-admin environments. Once exploited, the flaw enables extraction of sensitive database contents such as password hashes stored in wp_users, session tokens, API keys stored in wp_options, and any custom data managed by other plugins.
Root Cause
The root cause is improper neutralization of special elements used in a SQL command. The developer concatenated user-controlled input from filterbyauthor into a SQL string without calling WordPress's $wpdb->prepare() with proper placeholders or applying esc_sql() to the value. This allows SQL metacharacters and clauses supplied by the attacker to alter the query structure.
Attack Vector
The attack vector is network-based through the WordPress admin interface. An authenticated administrator submits a crafted value for the filterbyauthor parameter when browsing the polls listing page. The injected payload can use UNION-based, boolean-based, or time-based techniques to exfiltrate data. Because the query already runs with database privileges granted to the WordPress user, all tables in the WordPress schema are reachable. See the Wordfence advisory and the vulnerable source location for technical details.
Detection Methods for CVE-2025-12620
Indicators of Compromise
- Requests to wp-admin pages containing the filterbyauthor parameter with SQL metacharacters such as UNION, SELECT, SLEEP(, --, or single quotes
- Anomalous outbound queries or unusually large response payloads from admin listing pages
- New or modified rows in wp_users or wp_usermeta following administrator activity that included suspicious query strings
- Web server access logs showing repeated 200 responses to filterbyauthor values that differ only in payload structure
Detection Strategies
- Inspect PHP or MySQL slow-query logs for queries referencing the Poll Maker list table with malformed WHERE clauses
- Deploy a web application firewall rule that flags SQL syntax within the filterbyauthor parameter on WordPress admin endpoints
- Enable WordPress database query logging on high-value sites and alert on queries containing stacked statements or information_schema references originating from the plugin path
Monitoring Recommendations
- Audit administrator account activity, including login source IPs and session duration, to identify credential misuse
- Monitor for unexpected data reads against sensitive tables such as wp_users, wp_options, and any e-commerce or membership tables
- Track plugin version inventory across managed WordPress sites and alert when Poll Maker 6.0.7 or earlier remains installed after a patch is available
How to Mitigate CVE-2025-12620
Immediate Actions Required
- Update the Poll Maker plugin to a version later than 6.0.7 as soon as the vendor publishes a fixed release
- Review WordPress administrator accounts and remove or downgrade any accounts that do not require elevated privileges
- Enforce multi-factor authentication for all Administrator-level accounts to limit the impact of credential compromise
- Rotate WordPress user passwords, secret keys in wp-config.php, and any API tokens stored in the database if exploitation is suspected
Patch Information
At the time of publication, the fixed version is not specified in the NVD record. Site operators should consult the Wordfence vulnerability intelligence entry and the WordPress plugin repository for the latest patched release and changelog details.
Workarounds
- Deactivate and remove the Poll Maker plugin until a patched version is installed
- Restrict access to wp-admin by IP allowlist using web server configuration or a hosting-level firewall
- Apply a WAF rule that blocks requests where filterbyauthor contains characters outside the expected numeric or alphanumeric author identifier format
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.