This vulnerability arises from improper neutralization of special elements in SQL commands within the Ays Pro Poll Maker WordPress plugin, allowing an attacker to inject arbitrary SQL statements. The result can be unauthorized reading of database contents, modification of stored data, or other destructive actions that compromise both confidentiality and integrity of the site’s information. The assigned CVSS score of 7.6 reflects the potential impact when combined with the presence of a web‑accessible form.

WordPress installations that have the Poll Maker plugin version 5.6.5 or earlier are affected. This includes any site that has not upgraded beyond 5.6.5 and continues to use the poll creation or response interfaces provided by the plugin.

The EPSS score of less than 1% suggests that large‑scale exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack vector is straightforward: by submitting specially crafted input through the poll form or related endpoints, a remote actor can trigger blind SQL injection. Once the injection succeeds, the attacker can extract, modify, or delete data without needing user credentials beyond access to the poll interface.