Executive brief
CP Polls is a WordPress plugin used to create and manage interactive polls on websites. A security flaw allows an attacker to trick a logged-in administrator into performing unintended actions, such as changing poll settings or injecting malicious scripts. This could lead to unauthorized modifications of website content or the execution of malicious code in the administrator's browser.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress CP Polls plugin (version 1.0.8 and below) due to a lack of nonce validation on administrative actions. An attacker can exploit this by crafting a malicious HTML page or link and tricking an authenticated administrator into visiting it. Successful exploitation allows the attacker to modify poll settings, such as the poll name or structure. Furthermore, because the plugin fails to sanitize these settings before saving them to the database, this CSRF can be used to achieve Persistent Cross-Site Scripting (XSS) or manipulate file headers to trigger a malicious file download (e.g., a .bat file) when an admin attempts to export reports.
Affected products
- CodePeople CP Polls 1.0.8 and earlier
Timeline
- 2016-02-22: disclosed: Vulnerability discovered and exploit details documented by researcher.
- 2016-03-01: other: Exploit code published on Exploit-DB.
- 2026-06-15: advisory: CVE-2016-20067 published to the NVD.