CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the add() function. This makes it possible for unauthenticated attackers to place multiple votes on a single poll even when the poll is set to one vote per person.
Explanation of Vulnerability in Simple Terms
YOP Poll versions 6.5.26 and earlier contain a race condition that allows an attacker to modify poll data without authentication. The vulnerability exists because the plugin does not properly synchronize access to shared resources during concurrent requests. An attacker can exploit this over the network without user interaction to alter poll results or settings.
What an attacker can do
Modify poll data or results without authentication by exploiting a race condition in concurrent requests.
Potential impact on your site
Poll integrity compromised; attackers can alter poll results, questions, or settings without logging in.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
