# YOP Poll <= 7.0.13 - Authenticated (Author+) Incorrect Default Permissions to Modification, Deletion and Voter Data Access of Other Users' Polls

- **ID:** WPSEC-2026-1919
- **Plugin:** YOP Poll (`yop-poll`), https://wordpress.org/plugins/yop-poll/
- **Affected versions:** all versions before 7.1.0
- **Fixed in:** 7.1.0 (Update to 7.1.0 or later.)
- **Severity:** Medium 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-276
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yop-poll
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1919/

## Description

The YOP Poll plugin for WordPress is vulnerable to Incorrect Default Permissions via the plugin's default role capabilities in all versions up to, and including, 7.0.13, due to the plugin granting the yop_poll_edit_others, yop_poll_delete_others and yop_poll_results_others capabilities to the Author role by default. This makes it possible for authenticated attackers, with Author-level access and above, to edit, delete and reset polls created by other users, including administrators, and to view and export the votes on those polls, including voter email and IP addresses.

## References

- https://wpsec.com/vuln/WPSEC-2026-1919/
- https://plugins.svn.wordpress.org/yop-poll/tags/7.1.0/
- https://wordpress.org/plugins/yop-poll/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1919/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.