The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress contains a generic SQL Injection vulnerability in the 'filterbyauthor' parameter. Unsanitized input is inserted directly into a query, permitting attackers who possess Administrator‑level credentials to inject additional SQL commands. The result is the ability to retrieve sensitive data from the database, potentially exposing site content, user information, or payment details. The flaw requires a user to be authenticated at an administrative level and does not allow unauthenticated exploitation.

The vulnerability affects the ays‑pro Poll Maker plugin, versions up to and including 6.0.7, which is installed on WordPress sites. Site administrators using any of these affected versions may be targeted by privileged attackers. No other WordPress plugins or core components are listed as affected.

The CVSS score of 4.9 indicates a moderate impact, while the EPSS score of below 1% reflects a very low probability that the vulnerability will be exploited in the wild at this time. The flaw is not listed in the CISA KEV catalog, suggesting it is not currently being actively leveraged by organizations. Likely attack scenarios involve an attacker who already has administrator access or has compromised an administrative account through phishing or credential reuse. Once in possession of such access, the attacker can craft HTTP requests containing malicious 'filterbyauthor' values to inject SQL statements and read data from the database.