The Poll Maker – Versus Polls, Anonymous Polls, Image Polls WordPress plugin contains a Basic Information Exposure vulnerability (CWE-200) identified as CVE-2024-12575. This issue exists in all versions up to and including 5.8.9 and is exploitable via the 'ays_finish_poll' AJAX action. An unauthenticated attacker can leverage this to retrieve the administrator's email address from poll responses. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The impact is limited to confidentiality loss without affecting integrity or availability. No known exploits are reported in the wild, and no patch or official fix is currently documented.

The vulnerability allows unauthorized disclosure of the administrator's email address, which is sensitive information. This exposure could facilitate targeted phishing or social engineering attacks but does not directly compromise system integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the affected plugin's AJAX functionality or removing the plugin if feasible. Monitor official vendor channels for updates and apply patches promptly once available.