YOP Poll Plugin Vulnerability (CVE-2026-85682)

Security Alert Summary

The YOP Poll plugin for WordPress contains an origin validation error that can expose a wp_rest nonce to an attacker. The plugin posts a REST nonce to window.opener using postMessage() with a wildcard targetOrigin, allowing an attacker to steal a nonce scoped to a logged-in Administrator. An attacker who obtains that nonce can change the Administrator’s email address and password, enabling account takeover if the Administrator opens an attacker-controlled page.

CVE Details

• CVE ID: CVE-2026-85682
• Affected component: YOP Poll plugin for WordPress
• Affected versions: All versions up to and including 7.0.10
• Published: September 24, 2026 at 9:17:08 AM UTC
• Last modified: September 24, 2026 at 3:17:46 PM UTC
• CVSS v3.1: Base Score 8.8 – High
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
  • Confidentiality / Integrity / Availability Impact: High / High / High
• Authentication / Privileges / User Interaction: No attacker authentication required; exploitation requires a logged-in Administrator to open an attacker-controlled page (user interaction is required).
• CWE / Weakness: CWE-346 (Origin Validation Error)

Technical Details

The plugin transmits a wp_rest nonce value to window.opener via postMessage() but does so with a wildcard targetOrigin instead of validating the destination origin. Because the target origin is not restricted, any page that can receive the posted message can read the nonce value.

With a stolen REST nonce scoped to a logged-in Administrator, an unauthenticated attacker can use the nonce to perform privileged REST actions allowed by that nonce, including changing the Administrator’s email address and password. The description indicates the Administrator must open an attacker-controlled page for the exploit to occur, which aligns with the CVSS user interaction requirement.

How This Could Impact Your Website

Consider a site with multiple WordPress users: a site owner, an internal editor, and an external contractor who tests polls. If an Administrator account is active and that Administrator visits a malicious page (for example a contractor-clicked link or an attacker page opened in a popup), the attacker could steal a REST nonce and use it to change that Administrator’s email and password. That can result in loss of administrative access and the need to restore account settings.

Practical consequences include exposure of internal user email addresses used for account recovery and an increased risk of targeted phishing or social engineering against staff. If account credentials are changed, site operations and content management can be disrupted until access is restored.

professional review If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

• Update the affected plugin as soon as a patched version is available.
• Review and reduce unnecessary user roles, especially Administrator and Contributor accounts.
• Enforce strong passwords and enable two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins from your site.
• Monitor site activity and authentication logs for unusual behavior, such as unexpected password or email changes.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/changeset/3690945/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b3574182-1bda-49b2-aac7-60f862891b46?source=cve