Vulnerabilities / YOP Poll / WPSEC-2026-1919
YOP Poll <= 7.0.13 - Authenticated (Author+) Incorrect Default Permissions to Modification, Deletion and Voter Data Access of Other Users' Polls
Medium 6.3
CWE-276Fixed in 7.1.0
- ID
- WPSEC-2026-1919
- Plugin
- YOP Poll (yop-poll)
- Affected
- all versions before 7.1.0
- Remediation
- Update to 7.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-276
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- YOP Poll on WPSec AttackSurface
- Fix released
- Published
Description
The YOP Poll plugin for WordPress is vulnerable to Incorrect Default Permissions via the plugin's default role capabilities in all versions up to, and including, 7.0.13, due to the plugin granting the yop_poll_edit_others, yop_poll_delete_others and yop_poll_results_others capabilities to the Author role by default. This makes it possible for authenticated attackers, with Author-level access and above, to edit, delete and reset polls created by other users, including administrators, and to view and export the votes on those polls, including voter email and IP addresses.
References
- https://wpsec.com/vuln/WPSEC-2026-1919/
- https://plugins.svn.wordpress.org/yop-poll/tags/7.1.0/
- https://wordpress.org/plugins/yop-poll/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS