CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Poll Maker – Best WordPress Poll Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ays_poll_create_author function in all versions up to, and including, 5.1.8. This makes it possible for unauthenticated attackers to extract email addresses by enumerating them one character at a time.
Explanation of Vulnerability in Simple Terms
The Poll Maker plugin for WordPress contains a missing authorization check that allows unauthenticated attackers to read sensitive poll data. An attacker can access poll information without logging in or having permission to view it. This affects versions up to 5.1.8. Update to a version newer than 5.1.8 to resolve the issue.
What an attacker can do
Read poll data and responses without authentication or authorization.
Potential impact on your site
Unauthenticated visitors can view private or restricted poll information intended only for authorized users.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
