YOP Poll < 7.0.11 - Unauthenticated Administrator Account Takeover via Origin Validation Error in '/auth/wp-login-redirect'

Description

The plugin is vulnerable to Origin Validation Error due to transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.