What the vulnerability does
01Description
A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 6d7168cbf12d1c183bacc5cd5678f6f5b0d518d2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222268.
Explanation of Vulnerability in Simple Terms
02Summary
The CP Polls plugin for WordPress contains a SQL injection vulnerability in its database query handling. An attacker with administrative privileges can inject malicious SQL code to read, modify, or delete database records. The vulnerability requires high-level access to exploit and has limited scope, affecting only the plugin's data layer.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete database records via SQL injection.
Potential impact on your site
04Site Impact
A rogue admin account could extract sensitive data or corrupt poll data and site configuration.
Conditions required to exploit
05Prerequisites
Attacker must have WordPress administrator privileges; no user interaction required.
Key dates
06Disclosure timeline
March 4, 2023
CVE published
March 5, 2025
Record updated
