{
 "id": "WPSEC-2026-0462",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0462/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0462/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0462/index.md",
 "title": "YOP Poll <= 7.0.12 - Unauthenticated Information Exposure of Results on Registered-Only Polls",
 "description": "The YOP Poll plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 7.0.0 up to, and including, 7.0.12. This is because the plugin does not enforce the poll's 'Show results to: Registered' setting when it builds the public poll data returned by the poll results and vote REST endpoints and embedded in rendered polls. This makes it possible for unauthenticated attackers to view per-answer vote counts and totals of polls that the site owner has restricted to logged-in users, either after casting a guest vote or without voting when the poll's results are otherwise displayable. No voter personal data is exposed.",
 "plugin": {
  "slug": "yop-poll",
  "name": "YOP Poll",
  "full_name": "YOP Poll",
  "wordpress_org": "https://wordpress.org/plugins/yop-poll/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yop-poll/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yop-poll"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "7.0.0",
    "from_inclusive": true,
    "to": "7.0.13",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 7.0.0 before 7.0.13"
  ]
 },
 "introduced_in": "7.0.0",
 "fixed_in": "7.0.13",
 "remediation": "Update to 7.0.13 or later.",
 "fix_released": "2026-10-05T09:02:44+00:00",
 "published": "2026-10-06T17:44:03+00:00",
 "updated": "2026-10-06T16:46:18.950355+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0462/",
  "https://plugins.svn.wordpress.org/yop-poll/tags/7.0.13/",
  "https://wordpress.org/plugins/yop-poll/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yop-poll",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-06"
 }
}