Voting Manipulation Vulnerability in YOP Poll Plugin by WordPress
CVE-2026-14840
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14840?
The YOP Poll plugin for WordPress prior to version 7.0.6 is susceptible to a flaw that fails to properly validate the origin of connection IP addresses. This vulnerability allows unauthorized users to exploit the plugin's per-IP vote restrictions by trusting client-controlled forwarding headers. As a result, attackers can bypass vote limits and potentially manipulate public polls, severely undermining their integrity.
Affected Version(s)
YOP Poll 7.0.0 < 7.0.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.