CVE-2021-24762: Perfect Survey WordPress plugin unauthenticated SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with critical CVSS 9.8 and very high EPSS probability, with public exploit code available.

What it is

The Perfect Survey WordPress plugin before 1.5.2 fails to validate and escape the question_id GET parameter before using it in a SQL statement within the get_question AJAX action. This lets unauthenticated users inject arbitrary SQL, and the flaw carries a critical CVSS score of 9.8.

Impact

An attacker can read, modify or destroy database contents and potentially pivot further depending on database privileges. Full confidentiality, integrity and availability impact is scored.

Attack surface

Reachable over the network through the plugin's AJAX endpoint via the question_id GET parameter; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.868 (99.7th percentile) and public exploit references exist on Packet Storm and WPScan.

What to do

• Update the Perfect Survey plugin to version 1.5.2 or later immediately.
• If patching is not possible, disable or remove the plugin until it can be updated.
• Deploy a WAF rule blocking SQL injection patterns on the get_question AJAX action and question_id parameter.
• Restrict database account privileges used by WordPress to least privilege.
• Audit the database and logs for signs of tampering or data exfiltration.

Detection

• Monitor web server and WAF logs for requests to the plugin's AJAX endpoint with suspicious question_id values.
• Search for SQL keywords, comment sequences or UNION/OR patterns in GET parameters hitting the plugin.
• Review database logs for anomalous queries or errors originating from the WordPress application.
• Check for unexpected changes to survey or other database tables.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.