CVE-2024-9874 is a time-based SQL Injection vulnerability affecting the Poll Maker – Versus Polls, Anonymous Polls, Image Polls WordPress plugin up to version 5.4.6. The issue arises from improper neutralization of special elements in the 'orderby' parameter, allowing authenticated administrators to append malicious SQL commands to existing queries. This occurs because the plugin fails to sufficiently escape user input and does not use prepared statements for the affected SQL query. The vulnerability enables extraction of sensitive information from the database without impacting data integrity or availability. The CVSS 3.1 base score is 4.9, reflecting medium severity with network attack vector, low attack complexity, and high privileges required.

An attacker with Administrator-level access can exploit this vulnerability to perform time-based SQL Injection via the 'orderby' parameter, potentially extracting sensitive information from the database. The vulnerability does not allow modification or deletion of data (no integrity impact) nor does it affect system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the 'orderby' parameter. Avoid using the vulnerable plugin version if possible or consider disabling the plugin until a patch is released.