YOP Poll leaks an administrator REST nonce to an opener window
The plugin sends a wp_rest nonce to window.opener using postMessage() with a wildcard targetOrigin. An unauthenticated attacker must induce a logged-in Administrator to open an attacker-controlled page; the export describes use of the leaked nonce to change that administrator account email and password. The exact popup URL and follow-on request sequence are unspecified. A nonce is not a standalone WordPress login credential. Affected versions: <= 7.0.10. Confirmed fixed release: 7.0.11.
- Component
- YOP Poll
- Plugin slug
yop-poll- Affected
- <= 7.0.10
- Safe version
7.0.11- Published
- Sep 24, 2026
This CVE was published Sep 24, 2026 and is one of 13 known issues for this plugin.
Update, patch or deactivate.
Update to 7.0.11 or later, preferably the current supported release. Use a restricted poll-specific token rather than disclosing a general REST nonce, and bind cross-window messages to the expected origin. Review unexpected administrator email or password changes after suspected exposure. The official changelog matches this fix in 7.0.11. Official changelog: https://wordpress.org/plugins/yop-poll/#developers
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H