CVE-2025-12620 is an SQL Injection vulnerability in the Poll Maker – Versus Polls, Anonymous Polls, Image Polls WordPress plugin, affecting all versions up to 6.0.7. The issue arises from insufficient escaping and lack of proper preparation of the 'filterbyauthor' parameter in SQL queries. Authenticated attackers with Administrator-level access can append arbitrary SQL queries to extract sensitive information from the database. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity), with network attack vector, low attack complexity, and requiring high privileges. No patch or official fix has been published yet, and no known exploits are reported.

An attacker with Administrator-level access can exploit this vulnerability to perform SQL Injection via the 'filterbyauthor' parameter, potentially extracting sensitive data from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. Because exploitation requires high privileges, the risk is limited to users who already have significant access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Administrator-level access to trusted users only. Avoid using the vulnerable parameter if possible. Monitor official vendor channels for updates and apply patches promptly once released.