# CVE-2024-8625: TS Poll - SQLi

> Live exploitation tracking for CVE-2024-8625 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-8625

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.2
- **Public exploit available:** Yes
- **Affected products:** N/A TS Poll
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

The TS Poll  WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks

## CrowdSec analysis

[CVE-2024-8625](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-8625) is a vulnerability in the TS Poll WordPress plugin prior to version 2.4.0 that allows administrators to exploit unsanitized input for SQL injection attacks. This flaw could enable privileged users to manipulate database queries, potentially leading to data theft, unauthorized data modification, or disruption of site functionality.

CrowdSec has been tracking this vulnerability and its exploits since 25th of March 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-8625 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target the `/wp-admin/admin.php` endpoint with the `page=ts-poll` parameter, injecting SQL payloads via the `orderby` parameter to exploit the TS Poll plugin in vulnerable WordPress installations. This attack requires authenticated admin access and is used to execute arbitrary SQL commands.

## Timeline

- 2024-10-21: CVE Published. CVE-2024-8625 is published to NVD.
- 2026-03-25: Rule Released. CrowdSec releases a rule to detect CVE-2024-8625 exploitation attempts against the CrowdSec Network.
- 2026-08-19: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-8625 for the first time.

## References

- https://wpscan.com/vulnerability/ab4d7065-4ea2-4233-9593-0f540f91f45e/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-8625.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-8625) follows observed exploitation activity for CVE-2024-8625. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.