CVE-2021-24442 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection in WordPress 'Poll, Survey, Questionnaire and Voting system' plugin.…

🛡️ **Root Cause**: CWE-89 (SQL Injection). The plugin fails to **sanitize, escape, or validate** the `date_answers[]` POST parameter before injecting it into SQL queries.

📦 **Affected**: WordPress plugin **Poll, Survey, Questionnaire and Voting system** by **wpdevart**. Specifically versions **before 1.5.3**.

🕵️ **Attacker Capabilities**: Unauthenticated users can perform SQL Injection. This allows reading sensitive DB data, bypassing authentication, or potentially gaining server control depending on DB config.

⚡ **Threshold**: **LOW**. No authentication required! Any visitor can trigger the vulnerability via the POST parameter when sending poll results.

🔓 **Exploit Status**: **YES**. Public PoC exists via Nuclei templates and independent security researchers (e.g., in-spired.xyz). Wild exploitation is possible.

🔍 **Self-Check**: Scan for the specific plugin version. Look for unhandled `date_answers[]` POST parameters in HTTP traffic. Use automated scanners like Nuclei with the CVE-2021-24442 template.

🩹 **Fix**: **YES**. Update the plugin to version **1.5.3 or later**. The vendor has released a patch addressing the input validation issue.

🚧 **No Patch Workaround**: If you cannot update immediately, **disable the plugin** entirely. Alternatively, implement strict WAF rules to block SQL injection patterns in POST requests containing `date_answers[]`.

🔥 **Urgency**: **HIGH**. Critical flaw, no auth needed, public exploits available. Patch immediately to prevent potential data breaches or site compromise.