Poll Maker CVE-2026-8995

The attacker must hold an active, authenticated WordPress session at subscriber level or above (PR:L per CVSS vector). The Poll Maker plugin must be installed and activated on the target site - no special plugin configuration, feature flag, or non-default setting is required beyond plugin activation, as the AJAX action is registered unconditionally. Exploitation is blocked on WordPress instances where user registration is fully disabled and no non-administrative accounts exist, since the PR:L prerequisite cannot be met without a valid login. Nonce verification is absent, but authentication is still required - the endpoint is not exploitable by unauthenticated visitors. Based on available description data, the endpoint returns the calling user's own WP_User record; whether other users' records can be requested by manipulating parameters is not confirmed and should be verified with the vendor.

The CVSS 4.3 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) is broadly appropriate: the impact is limited to confidentiality with no integrity or availability consequence, and PR:L constrains exploitation to authenticated users. However, the raw CVSS underrepresents practical risk on WordPress sites with open registration, where the subscriber-level bar is trivially cleared by any self-registered user. The unique danger here is that the leaked field - the bcrypt password hash - is something WordPress explicitly refuses to expose through legitimate channels, meaning defenders may not anticipate it as a disclosure risk. Offline cracking of bcrypt hashes is computationally feasible for weak passwords and enables subsequent account takeover or credential reuse across other services. No EPSS data was provided; no CISA KEV listing exists; no public proof-of-concept exploit has been identified at time of analysis. The primary limiting factors are the PR:L requirement (sites with registration fully disabled and no non-admin accounts are not exploitable) and the fact that - based on the description - the endpoint appears to return the calling user's own data rather than arbitrary users' data, which constrains the blast radius to self-targeted hash exposure rather than mass user harvesting.

An attacker registers a free account on a WordPress site running Poll Maker ≤6.3.7, authenticates to obtain a valid session cookie, then issues a single POST request to wp-admin/admin-ajax.php with action=ays_poll_get_user_information. The plugin returns a serialized WP_User object containing the attacker's own bcrypt password hash - a value WordPress never surfaces through any standard interface. The attacker then subjects the hash to an offline dictionary attack; recovery of the plaintext password enables account takeover and potential credential reuse against other services where the same password was used.