Is CVE-2026-8995 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8995 being exploited in the wild.

How severe is CVE-2026-8995?

Medium severity, with a CVSS score of 4.3, published 29 May 2026.

Which products and versions are affected?

AYS Pro Poll Maker up to and including 6.3.7.

Is there a fix for CVE-2026-8995?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8995 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8995?

Check whether you run AYS Pro Poll Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8995: ays-pro Poll Maker sensitive information exposure in AJAX action

CVE-2026-8995 · Severity: medium · CVSS 4.3 · Published 2026-05-29

The Poll Maker plugin for WordPress, used to create interactive polls and surveys, contains a security flaw that exposes sensitive user account information. An attacker with a basic user account on the website can retrieve their own encrypted password hash and other profile details that are normally hidden. This information could be used in offline attacks to attempt to crack the user's password and gain further access.

Vendors: AYS Pro.

Quick answers

Is CVE-2026-8995 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8995 being exploited in the wild.
How severe is CVE-2026-8995?: Medium severity, with a CVSS score of 4.3, published 29 May 2026.
Which products and versions are affected?: AYS Pro Poll Maker up to and including 6.3.7.
Is there a fix for CVE-2026-8995?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8995 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8995?: Check whether you run AYS Pro Poll Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The 'ays_poll_get_user_information' AJAX action in the Poll Maker plugin fails to implement proper capability checks or nonce verification beyond verifying if a user is logged in. The function serializes and returns the entire WP_User object, which includes sensitive fields such as 'user_pass' (bcrypt password hash), 'user_email', and user roles. Authenticated attackers with subscriber-level permissions can exploit this to obtain their own password hash, which is not typically exposed by WordPress core. This hash can then be subjected to offline brute-force or dictionary attacks. The issue is fixed in version 6.3.8.

Affected products

ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image Polls up to and including 6.3.7

Timeline

2026-05-29: disclosed: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.