CVE-2024-12575 is a vulnerability classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) affecting the WordPress plugin Poll Maker – Versus Polls, Anonymous Polls, Image Polls, developed by ays-pro. The flaw exists in all versions up to and including 5.8.9 and is triggered via the 'ays_finish_poll' AJAX action. This endpoint improperly exposes the administrator's email address in the poll response data, allowing unauthenticated attackers to retrieve this sensitive information without any user interaction or privileges. The vulnerability is remotely exploitable over the network (AV:N), requires no authentication (PR:N), and has low attack complexity (AC:L). The confidentiality impact is limited to the disclosure of admin email addresses, with no impact on integrity or availability. The CVSS v3.1 base score is 5.3, indicating a medium severity level. No patches or fixes are currently linked, and no active exploitation has been reported. The exposure of admin emails can facilitate further attacks such as spear phishing or targeted social engineering campaigns against site administrators.

The primary impact of CVE-2024-12575 is the unauthorized disclosure of administrator email addresses from WordPress sites using the vulnerable Poll Maker plugin. This information leakage can enable attackers to conduct targeted phishing, spear phishing, or social engineering attacks against site administrators, potentially leading to credential compromise or further exploitation. While the vulnerability does not directly affect system integrity or availability, the exposure of sensitive contact information increases the attack surface and risk profile of affected organizations. Websites relying on this plugin may face reputational damage if attackers leverage the disclosed emails for malicious campaigns. The ease of exploitation and lack of authentication requirements increase the likelihood of opportunistic scanning and data harvesting by attackers.

1. Immediately update the Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin to a version that addresses this vulnerability once available. 2. If no patch is currently available, disable or remove the plugin temporarily to prevent exploitation. 3. Implement web application firewall (WAF) rules to block or restrict access to the 'ays_finish_poll' AJAX action endpoint from unauthenticated users. 4. Monitor web server logs for unusual or repeated requests to the vulnerable AJAX action to detect potential exploitation attempts. 5. Educate administrators about the risk of phishing and social engineering attacks, especially if their email addresses may have been exposed. 6. Consider obfuscating or limiting publicly exposed administrator contact information on the website to reduce attack surface. 7. Regularly audit installed WordPress plugins for vulnerabilities and maintain an up-to-date inventory to facilitate timely patching.