This vulnerability is a classic SQL Injection in the TS Poll WordPress plugin, triggered by the unescaped 's' query parameter. It allows an attacker who is authenticated with Administrator-level access to append arbitrary SQL commands to the existing query, resulting in the extraction of sensitive database contents. The weakness is a classic CWE-89 problem of insufficient input validation and lack of prepared statements.

The affected vendor is Totalsoft and the product is the TS Poll – Survey, Versus Poll, Image Poll, Video Poll WordPress plugin. All versions up to and including 2.4.6 are vulnerable and should be considered at risk until a newer version is applied.

The CVSS score of 4.9 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation under current conditions. The vulnerability is not listed in CISA’s KEV catalog, which further implies limited public exploitation. The likely attack vector is an authenticated user with Administrator privileges who can access the poll admin interface and supply a malicious value for the 's' parameter. Because the attacker must be authenticated, the exposure is confined to trusted administrators, but the impact remains significant if sensitive data is extracted.