CVE-2026-14840 — YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP…
Published: 2026-08-01 · CVSS: 5.3 · CVSS 3.1
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7