CVE-2024-13426 describes an SQL Injection vulnerability in the WP-Polls WordPress plugin (versions up to 2.77.2). The issue arises from improper neutralization of special elements in SQL commands, specifically via a COOKIE parameter that is insufficiently escaped and not properly prepared in SQL queries. This allows unauthenticated attackers to append additional SQL commands. While the injected SQL query results are not returned to the attacker, preventing direct data leakage, the vulnerability can be leveraged to inject stored malicious JavaScript, resulting in a stored Cross-Site Scripting condition.

An attacker can exploit this vulnerability to inject arbitrary SQL commands into the database queries executed by the plugin. Although direct data extraction is not possible due to lack of query result display, the attacker can inject malicious JavaScript that is stored and later executed in users' browsers, leading to stored XSS. This can compromise user sessions or perform other malicious actions in the context of affected users. The vulnerability affects confidentiality and integrity but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WP-Polls plugin or restricting access to it. Monitoring for updates from the vendor or plugin author is recommended to apply an official fix once released. Avoid relying on this plugin in untrusted environments until remediation is confirmed.