CVE-2024-9475 describes an SQL Injection vulnerability in the Poll Maker – Versus Polls, Anonymous Polls, Image Polls WordPress plugin. The issue arises from improper neutralization of special elements in the order_by parameter, which is not sufficiently escaped or prepared in SQL queries. Authenticated attackers with administrator privileges can exploit this to append SQL commands to existing queries, potentially extracting sensitive database information. The vulnerability affects all versions up to and including 5.4.6. No patch or vendor advisory is currently provided.

Successful exploitation allows an authenticated administrator-level user to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not impact integrity or availability directly but compromises confidentiality. The CVSS score of 4.9 reflects a medium severity impact focused on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and monitor for unusual database queries related to the order_by parameter. Avoid using vulnerable versions of the plugin if possible.