It’s a stored, blind SQL injection. I don’t know if there is a standard metric for calculating severity in the WordPress world, but the CVSS 3.0 base score is 9.0: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
The vulnerability is mitigated by the fact that a user has to have sufficient administrative access to modify the WP-Polls poll options (setting the question or answer sort order [ascending/descending] or sort method [random, id, etc.]).
It’s a trivial exploit: use your browser’s developer tools to modify the value attribute of any of the sort-related <OPTION> elements. That value is concatenated directly into SQL queries that are executed whenever the poll answer or result lists are displayed.
Impact is high: any data in the database could be modified (hopefully mitigated by good, long, random WP table prefixes and restricted WP database user privileges) and the filesystem could be written to or opened (based on database setup and process permissions). Confidentiality impact is relatively low because the easiest exploit is a blind SQL injection; it’s hard to simply list out all records in the DB, although a smarter attacker may be able to figure it out by leveraging other techniques in combination with the blind SQL injection.
As with any SQL injection it’d be hard to determine the scope of past attacks. You can see if any were active by looking at the following WP option variables and seeing if any crazy SQL-containing values are stored there (these would be overwritten any time the WP-Polls options are re-saved so you may want to search through backups):
- poll_ans_sortby – legal values:
- polla_aid
- polla_answers
- RAND()
- poll_ans_sortorder – legal values:
- poll_ans_result_sortby – legal values:
- polla_votes
- polla_aid
- polla_answers
- RAND()
- poll_ans_result_sortorder – legal values:
If you want to be very diligent, check your SQL server to see if it can write/modify files (often only in temporary locations, but some people run mysql as root for whatever crazy reason) and check if any suspicious files exist in writable locations.
