CVE-2026-85682

Name of the Vulnerable Software and Affected Versions YOP Poll versions prior to 7.0.11

Description The plugin contains an origin validation error where it transmits a wp rest nonce to window.opener using the postMessage() function with a wildcard targetOrigin. This allows unauthenticated attackers to steal a REST nonce associated with a logged-in Administrator. By exploiting this, an attacker can change the Administrator's email address and password via the '/auth/wp-login-redirect' endpoint, leading to a full account takeover. This requires the Administrator to visit a page controlled by the attacker.

Recommendations Update YOP Poll to version 7.0.11 or later.