EUVD-2026-51712
GHSA-jqjg-6w6p-5mh7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-reachable with no auth or interaction; integrity impact only (vote manipulation), no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
AnalysisAI
Vote-limit bypass in YOP Poll WordPress plugin before 7.0.6 allows unauthenticated remote attackers to cast unlimited votes on any public poll by spoofing IP addresses through client-controlled HTTP forwarding headers. The plugin enforces its per-IP vote restriction by reading attacker-supplied headers such as X-Forwarded-For rather than the validated TCP connection IP, making the restriction trivially circumventable. A publicly available proof-of-concept exists per WPScan reporting; EPSS sits at 0.14% (4th percentile), indicating low broad exploitation activity at time of analysis despite the low attack complexity.
Technical ContextAI
YOP Poll is a WordPress plugin for creating and embedding polls on WordPress sites. Per CPE cpe:2.3:a:unknown:yop_poll:*:*:*:*:*:*:*:*, the affected component is the poll voting endpoint that enforces per-IP submission limits. The root cause is CWE-290 (Authentication Bypass by Spoofing): the plugin reads one or more client-controllable HTTP headers - commonly X-Forwarded-For, X-Real-IP, or CF-Connecting-IP - to determine a voter's IP address instead of using the authoritative TCP source address known to the server. Because these headers are set by the client, an attacker can trivially rotate through arbitrary IP values across successive requests. This pattern is a well-documented trust boundary failure where proxy-forwarded headers intended for legitimate load-balancer infrastructures are accepted unconditionally in contexts where no trusted proxy exists between the client and the server.
RemediationAI
Update YOP Poll to version 7.0.6 or later, which is the vendor-released patch addressing this vulnerability. The fix should correct the plugin to derive the voter's IP from the server-side TCP connection rather than from client-supplied headers. WordPress site administrators should apply this update immediately via the WordPress admin dashboard (Plugins > Updates) or via WP-CLI: wp plugin update yop-poll. Until the update is applied, a partial compensating control is to disable any active polls that rely on per-IP vote restrictions, thereby removing the exploitable enforcement mechanism - though this also removes poll functionality. If a reverse proxy or CDN (Cloudflare, AWS ALB) sits in front of the WordPress instance, configuring the proxy to strip and re-inject X-Forwarded-For with the verified client IP before it reaches WordPress can mitigate the header-spoofing vector; however, this requires trusted-proxy configuration to be correctly implemented and does not substitute for patching.
The YOP Poll WordPress plugin before 6.1.2 does not escape the perpage parameter before outputting it back in an attribu
In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display o
The yop-poll plugin before 6.0.3 for WordPress has wp-admin/admin.php?page=yop-polls&action=view-votes poll_id XSS. Rate
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a
The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOT
Cross-site scripting vulnerability in YOP Poll versions prior to 5.8.1 allows remote attackers to inject arbitrary web s
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability which exists in th
The YOP Poll WordPress plugin before 6.3.1 is affected by a stored Cross-Site Scripting vulnerability, which exists in t
The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. Rated
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today