CVE-2025-24577: Medium Access Control Flaw in Poll Maker Plugin

CVE-2025-24577 is a medium severity missing authorization flaw (CVSS 6.5) in the Poll Maker WordPress plugin, versions up to and including 5.5.0. The record names no fixed version, so update to the newest release, confirm the issue is marked fixed, and remove the plugin if it is unused.

What's affected

The NVD record names the Poll Maker plugin by Ays Pro, in versions from n/a through 5.5.0. That wording means every release up to 5.5.0 is affected, and the record does not say which release fixes it. The weak check affects integrity and availability at a limited level, so the likely outcome is unwanted changes to poll data or settings, or disruption to polls.

The record is not on the CISA Known Exploited Vulnerabilities list.

The weakness is classed as CWE-862 (missing authorization). The score is 6.5 (MEDIUM). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is no on confidentiality, limited on integrity and limited on availability. The record was published on 2025-04-17.

The record gives no fixed version. The reference is a Patchstack database entry that I could not retrieve, so open it and the plugin's changelog page. A release newer than 5.5.0 is where to look, and the changelog should mention access control or authorization.

How to check if you're exposed

WordPress makes this check easy, with or without command line access.

1. In the dashboard, open Plugins, then Installed Plugins, and find Poll Maker. The version is listed under its name.
2. With WP-CLI on the server, list the version and whether an update is waiting.

wp plugin list --fields=name,version,update | grep -i poll-maker

3. If the version is 5.5.0 or lower, you are in the affected range.
4. On multisite, run the same list on each site, since each can have its own plugin state.
5. If you manage many sites, search your management tool or hosting panel for the plugin slug poll-maker.

What to do now

1. Update the Poll Maker plugin to the latest release.
2. Read the changelog and the Patchstack entry to confirm the access control issue is marked as fixed in the version you installed.
3. If you do not use the plugin, deactivate and delete it. A removed plugin cannot be attacked.
4. Review your site for unexpected changes made through the plugin's features, and check user accounts and roles.
5. Turn on automatic updates for plugins you rely on, or add them to a regular patch schedule.

Why it matters

Missing authorization, listed as CWE-862, means a feature works for callers who should not be allowed to use it. In WordPress plugins this often shows up as an action handler that never checks the visitor's role or a security token, so a request from a logged out user, or a low privileged one, is treated like an admin request.

The score is 6.5, which reflects limited integrity or availability impact and no need for credentials in the vector. That is a small number on its own. Across thousands of sites, though, small flaws are what automated scanners look for first, because the plugin slug and version are easy to read from a page. Keeping plugins updated and short is the cheap defence.

If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-24577
• NVD record data for CVE-2025-24577 (published 2025-04-17)
• Patchstack database entry (listed in the record, could not be retrieved)

Last reviewed: 19 October 2026.