Is CVE-2016-20067 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-20067 being exploited in the wild.

How severe is CVE-2016-20067?

Medium severity, with a CVSS score of 4.3, published 15 June 2026.

Which products and versions are affected?

CodePeople CP Polls 1.0.8 and earlier.

Is there a fix for CVE-2016-20067?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-20067 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2016-20067?

Check whether you run CodePeople CP Polls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-20067: WordPress CP Polls CSRF in poll settings

CVE-2016-20067 · Severity: medium · CVSS 4.3 · Published 2026-06-15

CP Polls is a WordPress plugin used to create and manage interactive polls on websites. A security flaw allows an attacker to trick a logged-in administrator into performing unintended actions, such as changing poll settings or injecting malicious scripts. This could lead to unauthorized modifications of website content or the execution of malicious code in the administrator's browser.

Vendors: CodePeople.

Quick answers

Is CVE-2016-20067 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-20067 being exploited in the wild.
How severe is CVE-2016-20067?: Medium severity, with a CVSS score of 4.3, published 15 June 2026.
Which products and versions are affected?: CodePeople CP Polls 1.0.8 and earlier.
Is there a fix for CVE-2016-20067?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-20067 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2016-20067?: Check whether you run CodePeople CP Polls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress CP Polls plugin (version 1.0.8 and below) due to a lack of nonce validation on administrative actions. An attacker can exploit this by crafting a malicious HTML page or link and tricking an authenticated administrator into visiting it. Successful exploitation allows the attacker to modify poll settings, such as the poll name or structure. Furthermore, because the plugin fails to sanitize these settings before saving them to the database, this CSRF can be used to achieve Persistent Cross-Site Scripting (XSS) or manipulate file headers to trigger a malicious file download (e.g., a .bat file) when an admin attempts to export reports.

Affected products

CodePeople CP Polls 1.0.8 and earlier

Timeline

2016-02-22: disclosed: Vulnerability discovered and exploit details documented by researcher.
2016-03-01: other: Exploit code published on Exploit-DB.
2026-06-15: advisory: CVE-2016-20067 published to the NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.