CVE-2026-14840 — YOP Poll < 7.0.6 Vote Limit Bypass

Author: nullwhisper
Use case: authorized security research / vulnerability validation only.

What is this?

YOP Poll plugin versions < 7.0.6 enforce a one-vote-per-IP limit. The problem is that to obtain the client IP it checks HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR before REMOTE_ADDR. Both headers are attacker- controlled, so an unauthenticated user can spoof a new IP on every request and cast unlimited votes.

• CVE: CVE-2026-14840
• Product: YOP Poll WordPress plugin
• Affected: < 7.0.6
• Fixed: 7.0.6
• Type: access-control bypass
• CVSS: 5.3

References

• WPScan: https://wpscan.com/vulnerability/fc810ca2-3f27-414d-b94a-68842925b7c6/
• CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-14840
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-14840

Files

.
├── cve_2026_14840_poc.py   # Main PoC
├── lab/
│   ├── docker-compose.yml  # WordPress lab
│   └── setup.php           # Creates a poll + public test page
├── requirements.txt
└── README.md

Install

pip3 install -r requirements.txt

Usage

Live target

python3 cve_2026_14840_poc.py -u https://target.com/page-with-poll -n 10

-n is the number of votes to cast. If more than one is accepted, the target is vulnerable.

The script automatically falls back to ?rest_route=/yop-poll/v1/votes when the site uses WordPress plain permalinks and /wp-json/... returns HTML.

Local lab

1. Download the vulnerable plugin (do not redistribute the plugin binary):

   root@kitploit:~

   mkdir -p lab/yop-poll
   cd lab/yop-poll
   wget https://downloads.wordpress.org/plugin/yop-poll.7.0.5.zip
   unzip yop-poll.7.0.5.zip && rm yop-poll.7.0.5.zip
   cd ../..
   

2. Start the lab:

   root@kitploit:~

   cd lab
   docker compose up -d
   

3. Complete the WordPress installer at http://127.0.0.1:8090.

4. Create the poll and test page:

   root@kitploit:~

   docker exec -i lab-wpcli-1 php /tmp/setup.php
   

5. Run the PoC:

   root@kitploit:~

   python3 cve_2026_14840_poc.py -u 'http://127.0.0.1:8090/?page_id=4' -n 5
   

Verified on localhost

Tested on WordPress 6.8 + YOP Poll 7.0.5 with default plain permalinks.

Same IP three times — limit works:

#1 201 -> Vote recorded successfully.
#2 403 -> You have already voted on this poll.
#3 403 -> You have already voted on this poll.

Different IP on every request via X-Forwarded-For — bypass works:

#1 201 -> Vote recorded successfully.
#2 201 -> Vote recorded successfully.
#3 201 -> Vote recorded successfully.

The wp_yoppoll_votes table grows by one row per spoofed IP, confirming the per-IP limit is bypassed.

Why the plugin is not included

This repo contains only the PoC and lab orchestration files. The YOP Poll plugin is GPL-2.0+, but distributing a full copy is unnecessary, bloats the repo, and can cause issues. Download version 7.0.5 from WordPress.org for your own lab.

Disclaimer

This tool is for authorized security testing and research only. Do not use it against systems you do not own or do not have explicit permission to test. The author is not responsible for misuse or damage caused by this code.