Technical impact
The vulnerability is a classic race condition caused by improper synchronization of shared resources within the Ays Pro Poll Maker plugin. When multiple requests manipulate the same poll data simultaneously, the plugin may process them in an interleaved order, resulting in corrupted data, inconsistent poll states, or a crash that could become a denial‑of‑service for the site. The weakness is identified as CWE‑362 and does not directly provide remote code execution or privilege escalation. The impact is limited to the integrity and availability of polls on affected WordPress installations.
Affected Systems
The affected product is the Ays Pro Poll Maker WordPress plugin, versions from the earliest available through 5.7.7. Administrators using any 5.7.7 or earlier installation of the Poll Maker free version on a WordPress site should consider their environment at risk. The vulnerability list includes the CPE identifier for ays‑pro:poll_maker free WordPress plugin.
Risk and Exploitability
The CVSS score of 5.3 indicates medium severity. The EPSS score is reported as less than 1%, suggesting a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers would likely need to trigger concurrent operations—such as creating or editing multiple polls at the same time—through the web interface or by sending rapid API calls. Because the flaw is tied to concurrent execution, it is most effectively exploited under high concurrency or a denial‑of‑service attempt. Patching or upgrading the plugin mitigates the risk completely.
EUVD