CVE-2025-26971 is a High severity (CVSS 7.6) blind SQL injection in the Ays Pro Poll Maker WordPress plugin, version 5.6.5 and earlier. Patchstack lists 5.6.6 as the fix and notes an administrator account is needed. Update to 5.6.6 or later.
What's affected
Affected: Poll Maker (slug poll-maker) by Ays Pro, version 5.6.5 and earlier. Fixed: 5.6.6, per the Patchstack entry.
Patchstack lists the required privilege as Administrator and gives the entry a low priority, noting no impactful threat. The CVSS vector agrees: privileges required are high. That makes this less urgent than an unauthenticated bug, but it is still worth a routine update, and it matters more on sites with many administrators or shared credentials.
The record describes blind SQL injection, which means results are not shown directly to the person sending the request.
How to check if you're exposed
Check the plugin version with WP-CLI:
wp plugin list --name=poll-maker --fields=name,status,version,update_version
Or read it from the plugin file:
grep -m1 "Version:" wp-content/plugins/poll-maker/*.php
Anything at or below 5.6.5 is affected. Because the attack needs an administrator, also review who holds that role:
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
Remove administrator rights from accounts that do not need them, and check that each remaining administrator uses a strong password and two factor authentication.
What to do now
- Find every site that runs Poll Maker.
- Update to 5.6.6 or later.
- Review administrator accounts and remove unused ones.
- Require two factor authentication for administrators.
- Back up the database before updating, as with any plugin change.
- Consider whether you need the plugin at all, and remove it if not.
Why it matters
The record lists CWE-89. Blind SQL injection is the same weakness as ordinary SQL injection, except the application does not print the query result. An attacker can still learn information by watching how the application behaves, for example whether a response is slower or different.
The impact score is high for confidentiality, which reflects the database contents, and low for availability. The scope is changed. The need for administrator access is the key limiter. The record's KEV flag is false, so it is not in the CISA Known Exploited Vulnerabilities catalog.
Administrator only bugs are a reminder that account hygiene is part of patching. A compromised or careless administrator turns a modest flaw into a real one.
Quick check
Do I need to hurry if this needs an administrator?
Less than for an unauthenticated bug. Still update during your normal cycle, and tighten administrator accounts.
Which version fixes it?
Patchstack lists 5.6.6 as the patched version.
Sources
Last reviewed: 19 October 2026.
