Executive brief
The YOP Poll plugin for WordPress, which is used to create and manage online surveys and polls, contains a flaw in how it identifies voters. An attacker can bypass restrictions meant to limit one vote per person by spoofing their network address. This allows a single user to cast an unlimited number of votes, potentially manipulating the results of public polls and damaging the integrity of the data collected.
Technical details
The YOP Poll plugin for WordPress (versions prior to 7.0.6) is vulnerable to an IP address spoofing flaw (CWE-290). The vulnerability exists because the plugin relies on client-controlled HTTP forwarding headers (such as X-Forwarded-For) to identify the voter's IP address for the purpose of enforcing vote limits. An unauthenticated remote attacker can manipulate these headers to present a unique IP address for each request, thereby bypassing the 'one vote per IP' restriction. This allows for automated, unlimited voting on public polls. The issue is resolved in version 7.0.6.
Affected products
- Unknown YOP Poll < 7.0.6
Timeline
- 2026-07-20: disclosed: Publicly published by WPScan
- 2026-07-20: patched: Fixed in version 7.0.6
- 2026-08-01: advisory: CVE published to NVD dataset