CVE-2024-12115 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the Poll Maker – Versus Polls, Anonymous Polls, Image Polls WordPress plugin up to version 5.5.4. The issue is caused by missing or incorrect nonce validation on the duplicate_poll() function, which enables an attacker to perform unauthorized poll duplication by tricking an authenticated administrator into submitting a malicious request. The vulnerability does not require privileges or direct user interaction beyond the administrator clicking a crafted link. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, no privileges required, but requiring user interaction and causing limited impact to integrity only.

An attacker can cause an authenticated site administrator to unknowingly duplicate polls by sending a crafted request, potentially leading to unintended poll duplication. There is no impact on confidentiality or availability. The integrity impact is limited to unauthorized duplication of poll data. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should be cautious about clicking untrusted links while logged into the WordPress admin interface. Implementing additional CSRF protections or nonce validation in the plugin code could mitigate the risk. Monitor the vendor's official channels for updates or patches.