CVE-2026-14840: YOP Poll WordPress Auth Bypass Flaw

CVE-2026-14840 Overview

CVE-2026-14840 affects the YOP Poll WordPress plugin in versions prior to 7.0.6. The plugin enforces a per-IP vote restriction but relies on client-controlled HTTP forwarding headers instead of the connection's actual origin IP address. Unauthenticated attackers can manipulate headers such as X-Forwarded-For to bypass the vote limit and submit unlimited votes on any public poll. The flaw maps to CWE-290: Authentication Bypass by Spoofing and undermines the integrity of any poll deployed with the affected versions.

Critical Impact
Unauthenticated attackers can cast unlimited votes on public polls, corrupting poll results and rendering the plugin's per-IP anti-abuse control ineffective.

Affected Products

YOP Poll WordPress plugin versions prior to 7.0.6
WordPress sites running public polls with the affected plugin
Any deployment relying on YOP Poll's per-IP vote restriction as an integrity control

Discovery Timeline

2026-08-01 - CVE-2026-14840 published to the National Vulnerability Database
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-14840

Vulnerability Analysis

The YOP Poll plugin enforces a rate limit that permits one vote per IP address on a given poll. To identify the voter's IP, the plugin reads values from HTTP request headers instead of the TCP connection's remote address. Attackers control these headers on every request they send, so the per-IP check inspects data supplied by the same actor it is meant to constrain.

By rotating the value of forwarding headers such as X-Forwarded-For, X-Real-IP, or Client-IP, an unauthenticated attacker appears to originate from a new IP with each request. The plugin records each spoofed address as unique and accepts each vote. This defeats the anti-abuse control without requiring authentication, user interaction, or elevated privileges.

The impact is limited to poll integrity. The confidentiality impact is low, and no direct data disclosure, code execution, or availability loss results from the flaw.

Root Cause

The root cause is improper trust of client-supplied identity data. Server-side logic must derive the origin IP from the TCP peer address (for example, REMOTE_ADDR), or from forwarding headers only when the request traverses a trusted reverse proxy configured to overwrite those headers. YOP Poll performs neither validation.

Attack Vector

Exploitation requires only a network path to the target WordPress site and knowledge of the poll's public voting endpoint. An attacker scripts repeated POST requests to the voting handler and mutates the forwarding header value on each request. No credentials, tokens, or session state are needed. The attacker can automate thousands of submissions to skew results toward a chosen option. See the WPScan Vulnerability Detail for further technical context.

Detection Methods for CVE-2026-14840

Indicators of Compromise

Large volumes of vote submission requests to YOP Poll endpoints (typically admin-ajax.php with a YOP Poll action parameter) from a single source IP address
Requests containing X-Forwarded-For, X-Real-IP, or Client-IP headers with values that change on every request or follow sequential patterns
Rapid, statistically improbable shifts in poll tallies over short time windows

Detection Strategies

Compare the TCP source IP recorded by the web server with the X-Forwarded-For value in application logs; sustained mismatches from non-proxy sources indicate spoofing attempts
Alert on vote submission request rates that exceed a reasonable per-source threshold within a rolling window
Correlate User-Agent, TLS fingerprint, and cookie values across requests claiming different forwarded IPs to identify a single actor cycling headers

Monitoring Recommendations

Enable verbose access logging on WordPress vhosts and capture all HTTP forwarding headers alongside REMOTE_ADDR
Ingest web server and WordPress logs into a centralized analytics platform and build dashboards for YOP Poll endpoints
Configure a Web Application Firewall (WAF) to log and rate-limit unauthenticated POSTs to poll voting endpoints

How to Mitigate CVE-2026-14840

Immediate Actions Required

Update the YOP Poll plugin to version 7.0.6 or later on all WordPress sites
Audit existing poll data for anomalies and reset any polls whose results may have been manipulated
Restrict who can create public polls until patching is verified across the environment

Patch Information

Upgrade YOP Poll to version 7.0.6 or later. The fixed release derives the voter IP from the connection's origin address rather than trusting client-controlled forwarding headers. Refer to the WPScan Vulnerability Detail for advisory details.

Workarounds

Deploy a WAF rule that strips or normalizes X-Forwarded-For, X-Real-IP, and Client-IP headers on requests to YOP Poll voting endpoints before they reach WordPress
Enforce aggressive rate limiting at the reverse proxy or WAF for POST requests to poll submission handlers
Disable public polls or require authenticated voting until the plugin is upgraded to 7.0.6

bash

# Example NGINX configuration to override client-supplied forwarding headers
# Place inside the server block fronting WordPress
location ~ ^/wp-admin/admin-ajax\.php$ {
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP       $remote_addr;
    proxy_set_header Client-IP       $remote_addr;
    limit_req zone=poll_votes burst=5 nodelay;
    proxy_pass http://wordpress_upstream;
}