CVE-2015-2090 WordPress Survey & Poll – Quiz, Survey and Poll Plugin for WordPress < 1.2 - SQL Injection
HighCVSS 7.5
EPSS 4.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sympies wordpress survey and poll | = 1.1.7 | No fix listed |
| wordpress wp-survey-and-poll(WordPress) | < 1.2 | 1.2 |
References
- 118218 vdb-entry
- packetstormsecurity.com exploit
- 36054 exploit
- 74890 vdb-entry
- wordpress.org
- Wordfence Intelligence third-party-advisory
- www.cve.org