{
 "id": "WPSEC-2026-1919",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1919/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1919/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1919/index.md",
 "title": "YOP Poll <= 7.0.13 - Authenticated (Author+) Incorrect Default Permissions to Modification, Deletion and Voter Data Access of Other Users' Polls",
 "description": "The YOP Poll plugin for WordPress is vulnerable to Incorrect Default Permissions via the plugin's default role capabilities in all versions up to, and including, 7.0.13, due to the plugin granting the yop_poll_edit_others, yop_poll_delete_others and yop_poll_results_others capabilities to the Author role by default. This makes it possible for authenticated attackers, with Author-level access and above, to edit, delete and reset polls created by other users, including administrators, and to view and export the votes on those polls, including voter email and IP addresses.",
 "plugin": {
  "slug": "yop-poll",
  "name": "YOP Poll",
  "full_name": "YOP Poll",
  "wordpress_org": "https://wordpress.org/plugins/yop-poll/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yop-poll/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yop-poll"
 },
 "type": "PRIV",
 "cwe": [
  "CWE-276"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.1.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.1.0",
 "remediation": "Update to 7.1.0 or later.",
 "fix_released": "2026-10-28T13:08:25+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:42:31.317895+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1919/",
  "https://plugins.svn.wordpress.org/yop-poll/tags/7.1.0/",
  "https://wordpress.org/plugins/yop-poll/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yop-poll",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-29"
 }
}