CVE-2021-24442: WPDevArt Polls WordPress plugin unauthenticated SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with a 9.8 CVSS score, public exploit references and high EPSS probability makes this an urgent patch.

What it is

The WPDevArt Poll, Survey, Questionnaire and Voting System WordPress plugin before 1.5.3 passes the date_answers[] POST parameter into a SQL statement without sanitisation, escaping or validation when a poll result is submitted. This allows unauthenticated SQL injection, and the flaw is rated critical with a 9.8 CVSS score.

Impact

An attacker can read, modify or destroy database contents, including WordPress user credentials and site data, and may be able to pivot further depending on database privileges.

Attack surface

Reachable over the network through the plugin's poll result submission endpoint; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is 0.45996 (98.75th percentile) and both references are tagged Exploit, indicating public exploit detail exists.

What to do

• Update the WPDevArt Poll, Survey, Questionnaire and Voting System plugin to 1.5.3 or later.
• If patching is not immediately possible, disable or remove the plugin until it can be updated.
• Deploy a WAF rule blocking SQL injection patterns in the date_answers[] POST parameter.
• Restrict database account privileges used by WordPress to the minimum required.
• Audit the site for signs of compromise and rotate credentials if SQL injection is suspected.

Detection

• Monitor web server and WAF logs for SQL keywords or unusual characters in POST parameters to poll result endpoints.
• Review database query logs for anomalous SELECT, UNION or stacked queries originating from the web application.
• Check for unexpected changes to WordPress users, options or plugin data that could indicate post-exploitation.
• Search for requests to the plugin's poll submission path from IPs with no prior site activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.