Voting Manipulation Vulnerability in YOP Poll Plugin by WordPress
CVE-2026-14840
5.3MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14840?
The YOP Poll plugin for WordPress prior to version 7.0.6 is susceptible to a flaw that fails to properly validate the origin of connection IP addresses. This vulnerability allows unauthorized users to exploit the plugin's per-IP vote restrictions by trusting client-controlled forwarding headers. As a result, attackers can bypass vote limits and potentially manipulate public polls, severely undermining their integrity.
Affected Version(s)
YOP Poll 7.0.0 < 7.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved
Credit
Melina Lentini (M3l3n)
WPScan