Responsive Poll < 1.3.4 - Broken Authentication and Missing Capability Checks on AJAX calls

Description

Edit (WPScanTeam):

In versions < 1.3.3, unauthenticated users can manipulate polls, e.g., delete, clone, or view a hidden poll.
In versions < 1.3.4 any authenticated user can do the same as above

v1.3.4 added capability checks, however the issues are still exploitable via CSRF as there is no nonce checks