CVE-2026-14840: Unknown Yop Poll

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.

Affected products

• Unknown Yop Poll: from 7.0.0, before 7.0.6 (fixed in 7.0.6)

Published 2026-08-01. Last modified 2026-08-26.