Executive brief
The Poll Maker plugin for WordPress, used to create interactive polls and surveys, contains a security flaw that exposes sensitive user account information. An attacker with a basic user account on the website can retrieve their own encrypted password hash and other profile details that are normally hidden. This information could be used in offline attacks to attempt to crack the user's password and gain further access.
Technical details
The 'ays_poll_get_user_information' AJAX action in the Poll Maker plugin fails to implement proper capability checks or nonce verification beyond verifying if a user is logged in. The function serializes and returns the entire WP_User object, which includes sensitive fields such as 'user_pass' (bcrypt password hash), 'user_email', and user roles. Authenticated attackers with subscriber-level permissions can exploit this to obtain their own password hash, which is not typically exposed by WordPress core. This hash can then be subjected to offline brute-force or dictionary attacks. The issue is fixed in version 6.3.8.
Affected products
- ays-pro Poll Maker – Versus Polls, Anonymous Polls, Image Polls up to and including 6.3.7
Timeline
- 2026-05-29: disclosed: CVE published to NVD dataset
References
- https://plugins.trac.wordpress.org/browser/poll-maker/tags/6.2.7/includes/class-poll-maker-ays.php
- https://plugins.trac.wordpress.org/browser/poll-maker/tags/6.2.7/public/class-poll-maker-ays-public.php
- https://plugins.trac.wordpress.org/browser/poll-maker/tags/6.2.7/public/class-poll-maker-ays-public.php
- https://plugins.trac.wordpress.org/browser/poll-maker/tags/6.3.7/includes/class-poll-maker-ays.php
- https://plugins.trac.wordpress.org/browser/poll-maker/tags/6.3.7/public/class-poll-maker-ays-public.php
- https://plugins.trac.wordpress.org/browser/poll-maker/tags/6.3.7/public/class-poll-maker-ays-public.php
- https://plugins.trac.wordpress.org/browser/poll-maker/tags/6.3.8/includes/class-poll-maker-ays.php