Poll Maker By Ays Versus Polls Anonymous Polls Image Polls
Monthly
Poll Maker WordPress plugin (versions ≤6.3.7) leaks the complete WP_User object - including bcrypt password hashes, email addresses, login names, registration dates, roles, and capabilities - through an AJAX endpoint that performs no nonce verification or capability check beyond confirming the requestor is logged in. Any subscriber-level authenticated user on an affected site can call the `ays_poll_get_user_information` action and retrieve user data that WordPress deliberately withholds from all of its standard interfaces, including the REST API. No public exploit has been identified at time of analysis, but the attack requires only a valid subscriber session and a single POST request, and the recovered bcrypt hash enables offline password-cracking attacks.
Poll Maker WordPress plugin (versions ≤6.3.7) leaks the complete WP_User object - including bcrypt password hashes, email addresses, login names, registration dates, roles, and capabilities - through an AJAX endpoint that performs no nonce verification or capability check beyond confirming the requestor is logged in. Any subscriber-level authenticated user on an affected site can call the `ays_poll_get_user_information` action and retrieve user data that WordPress deliberately withholds from all of its standard interfaces, including the REST API. No public exploit has been identified at time of analysis, but the attack requires only a valid subscriber session and a single POST request, and the recovered bcrypt hash enables offline password-cracking attacks.