TS Poll
CVE-2024-9022
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The TS Poll - Survey, Versus Poll, Image Poll, Video Poll plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.4.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL injection in the TS Poll WordPress plugin (versions up to and including 2.4.0) allows authenticated attackers with Administrator-level access to append arbitrary SQL queries via the 'orderby' parameter, enabling extraction of sensitive database contents. Publicly available exploit code exists, though the high-privilege requirement (PR:H) limits practical impact, and EPSS sits at 2.11% (84th percentile) indicating modest but non-trivial exploitation interest. No public exploit identified as actively used in the wild - not listed in CISA KEV.
Technical ContextAI
TS Poll is a WordPress plugin by Total Soft (CPE cpe:2.3:a:total-soft:ts_poll) providing survey, versus, image, and video poll functionality. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically stemming from insufficient escaping of the user-supplied 'orderby' parameter combined with a lack of prepared statement usage in the underlying SQL query construction. Because 'orderby' parameters typically cannot be safely parameterized in standard prepared-statement APIs (they identify column names, not values), the WordPress-recommended pattern is strict allowlisting against known column names - a control evidently absent here, allowing the parameter to be concatenated into the final query string.
RemediationAI
Upgrade the TS Poll plugin to a version higher than 2.4.0 once the vendor publishes a patched release; consult the Wordfence advisory and the WordPress.org plugin changelog for the exact fixed version, as no specific patched version is independently confirmed in the available data. If a fixed version is not yet available or cannot be deployed immediately, compensating controls include deactivating and removing the TS Poll plugin entirely (trade-off: loss of poll functionality), restricting WordPress Administrator role assignment to the minimum necessary accounts and enforcing multi-factor authentication on those accounts to raise the bar for the PR:H prerequisite, and deploying a WAF rule (Wordfence, Sucuri, or ModSecurity) to inspect requests to TS Poll admin endpoints for SQL metacharacters in the 'orderby' parameter (trade-off: potential false positives on legitimate sort operations).
Share
External POC / Exploit Code
Leaving vuln.today