WordPress Plugin Vulnerabilities

YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing

Description

The plugin does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.

Proof of Concept

Affects Plugins

Plugin icon
yop-poll
Fixed in 7.0.6

References

CVE
CVE-2026-14840

Classification

Type
SPOOFING
OWASP top 10
A5: Broken Access Control
CWE
CWE-290
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Melina Lentini (M3l3n)
Submitter
Melina Lentini (M3l3n)
Verified
Yes
WPVDB ID
fc810ca2-3f27-414d-b94a-68842925b7c6

Timeline

Publicly Published
2026-07-20 (about 13 days ago)
Added
2026-07-20 (about 12 days ago)
Last Updated
2026-07-20 (about 12 days ago)

Other

Published
Title
Published
2025-10-09
Title
All In One Login 2.0.8 - IP Sooofing to Protection Mechanism Bypass
Published
2026-01-06
Title
AA Block country <= 1.0.1 - Unauthenticated IP Address Spoofing via X-Forwarded-For Header
Published
2024-09-04
Title
Security, Antivirus, Firewall – S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass
Published
2024-03-28
Title
Newsletter < 8.2.1 - IP Spoofing
Published
2025-10-30
Title
OOPSpam Anti-Spam < 1.2.54 - Unauthenticated IP Header Spoofing