YOP Poll CVE-2026-85682

Exploitation requires that a logged-in WordPress Administrator actively open an attacker-controlled page (UI:R) while the YOP Poll plugin (version 7.0.10 or earlier) is installed and active on the target site. The specific technical prerequisite is the plugin's use of postMessage() with a wildcard '*' targetOrigin to transmit the wp_rest nonce to window.opener, which allows any origin to receive the administrator-scoped nonce. No authentication is needed by the attacker (PR:N), but the reliance on tricking an administrator into visiting a malicious page is the primary limiting factor - the attack cannot proceed without that user interaction and an active admin session.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) describes a network-reachable, low-complexity, unauthenticated attack yielding full compromise (C:H/I:H/A:H) of an Administrator account, moderated only by the required user interaction (UI:R): the victim admin must open an attacker-controlled page. The attack chain is concrete and credible - a wildcard-targetOrigin postMessage() leaks a live wp_rest nonce that is then replayed to change the admin's email and password. EPSS, CISA KEV, and public POC signals are all absent from the input, so exploitation status is 'no public exploit identified at time of analysis'; this tempers urgency somewhat but does not reduce the technical severity, since the flaw was described in detail by Wordfence and the fix commit is public (trac changeset 3690945), which lowers the barrier to reverse-engineering a working exploit. The main real-world limiter is social engineering: an attacker must lure a logged-in administrator to a malicious page, so mass, hands-off exploitation is less likely than targeted phishing of site operators. Net: patch promptly, especially on sites where admins routinely browse untrusted links.

An attacker crafts a malicious web page and, via phishing or a planted link, convinces a logged-in WordPress administrator to open it (e.g., in a new tab opened by the plugin flow). Because the YOP Poll plugin broadcasts the admin's wp_rest nonce to window.opener using postMessage() with a wildcard '*' targetOrigin, the attacker's page silently captures that nonce and replays it against the WordPress REST API to change the administrator's email address and password, achieving full account takeover. No public exploit code is identified in the provided data, but the vulnerability and the patch are publicly documented by Wordfence.