CVE-2025-3470 is an SQL Injection vulnerability in the totalsoft TS Poll plugin for WordPress (versions ≤ 2.4.6). It results from insufficient escaping and lack of proper query preparation of the user-supplied 's' parameter. Authenticated attackers with Administrator privileges can append malicious SQL queries to existing database queries, potentially extracting sensitive information. The vulnerability does not affect availability or integrity but impacts confidentiality. No patch or official fix has been disclosed yet.

Successful exploitation allows an authenticated administrator-level user to perform SQL Injection attacks, leading to unauthorized disclosure of sensitive information from the database. There is no indication of impact on data integrity or availability. The vulnerability requires high privileges and network access but no user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the 's' parameter in the plugin. Avoid using vulnerable versions of the TS Poll plugin if possible.