Survey and Poll <= 1.1 is vulnerable to Blind SQL Injection

Unauthenticated

Published
2015-02-10

SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.

CVE

https://www.cve.org/CVERecord?id=CVE-2015-2090

CVSS

Score:9.8

Severity:Critical

Version: 1.1

There is a patch available in v1.2 and we strongly recommend you update to this version as soon as possible.