What is the CVSS score of EUVD-2026-33247?

EUVD-2026-33247 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Poll Maker EUVD-2026-33247

| CVE-2026-8995 MEDIUM

Information Exposure (CWE-200)

2026-05-29 Wordfence

GHSA-5846-9fv5-4429

Information Disclosure WordPress

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 03:42 vuln.today

CVE Published

May 29, 2026 - 02:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The Poll Maker - Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 6.3.7. This is due to insufficient access controls on the 'ays_poll_get_user_information' AJAX action, which serializes and returns the complete WP_User object - including the user_pass (bcrypt password hash), user_email, user_login, user_registered, roles, and all capabilities - without any nonce verification or capability check beyond is_user_logged_in(). This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive account data including their own password hash, which WordPress does not expose through any of its standard interfaces and which can be leveraged for offline password-cracking attacks.

AnalysisAI

Poll Maker WordPress plugin (versions ≤6.3.7) leaks the complete WP_User object - including bcrypt password hashes, email addresses, login names, registration dates, roles, and capabilities - through an AJAX endpoint that performs no nonce verification or capability check beyond confirming the requestor is logged in. Any subscriber-level authenticated user on an affected site can call the ays_poll_get_user_information action and retrieve user data that WordPress deliberately withholds from all of its standard interfaces, including the REST API. No public exploit has been identified at time of analysis, but the attack requires only a valid subscriber session and a single POST request, and the recovered bcrypt hash enables offline password-cracking attacks.

Technical ContextAI

The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to Unauthorized Actor) and resides in the Poll Maker plugin by AYS Pro (CPE: cpe:2.3:a:ays-pro:poll_maker_by_ays_-_versus_polls,_anonymous_polls,_image_polls:*:*:*:*:*:*:*:*). The AJAX handler ays_poll_get_user_information is registered in class-poll-maker-ays.php at line 318 and implemented in class-poll-maker-ays-public.php around lines 2960-2967. The handler serializes and returns the raw PHP WP_User object without any sanitization. WordPress's core architecture deliberately never exposes the user_pass field (a bcrypt hash) through any REST API endpoint or admin UI; this plugin bypasses that safeguard by directly dumping the internal user object. The absence of nonce verification additionally removes CSRF protections, though the PR:L CVSS parameter confirms authentication is still required.

RemediationAI

Update Poll Maker to version 6.3.8 or later. The WordPress plugin SVN repository includes a 6.3.8 tag with changes to both class-poll-maker-ays-public.php and class-poll-maker-ays.php - the two files containing the vulnerable handler - indicating 6.3.8 is the patched release; however, an explicit vendor changelog confirming the fix was not independently cited in the available data, so the fix version is inferred from SVN evidence rather than a formal advisory statement. If immediate upgrade is not feasible, administrators should add a WAF rule blocking POST requests to wp-admin/admin-ajax.php where the action parameter equals ays_poll_get_user_information from any user role below administrator; this eliminates the attack vector with no impact on legitimate poll functionality for visitors. Disabling open user registration reduces the exposed attack surface by preventing new accounts at subscriber level, though it does not protect against exploitation by existing subscribers. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5d1ff79e-5246-422a-ae75-20763e7acd17 for further guidance.