CVE-2026-27044: Total Poll Lite RCE Vulnerability

CVE-2026-27044 Overview

CVE-2026-27044 is a critical code injection vulnerability affecting the TotalSuite Total Poll Lite WordPress plugin. The vulnerability stems from improper control of code generation (CWE-94), enabling remote code inclusion attacks. Authenticated attackers with low privileges can exploit this flaw to execute arbitrary code on vulnerable WordPress installations, potentially leading to complete site compromise.

Critical Impact
Attackers can achieve remote code execution on affected WordPress sites, enabling full server compromise, data theft, and malware deployment.

Affected Products

TotalSuite Total Poll Lite plugin versions through 4.12.0
WordPress installations running vulnerable versions of the totalpoll-lite plugin

Discovery Timeline

2026-03-25 - CVE-2026-27044 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-27044

Vulnerability Analysis

This vulnerability is classified as Improper Control of Generation of Code (CWE-94), which occurs when the application constructs code segments using externally-influenced input without proper neutralization. In the context of the Total Poll Lite plugin, the flaw allows remote code inclusion, meaning an attacker can inject and execute malicious code on the target server.

The attack can be performed over the network and requires only low-level authentication, making it particularly dangerous in shared hosting environments or sites with multiple user accounts. The vulnerability has a changed scope, indicating that exploitation can impact resources beyond the vulnerable component itself—potentially affecting the underlying WordPress installation, database, and server infrastructure.

Root Cause

The root cause lies in insufficient input validation and sanitization within the Total Poll Lite plugin's code generation mechanisms. The plugin fails to properly neutralize user-supplied input before incorporating it into dynamically generated code, creating an injection point that attackers can leverage for remote code inclusion.

Attack Vector

The vulnerability is exploitable over the network by authenticated users with minimal privileges. An attacker would need to:

Obtain or create a low-privilege account on the target WordPress installation
Craft malicious input designed to inject code through the vulnerable poll functionality
Submit the payload through the plugin's interface
Achieve remote code execution on the server

The attack does not require user interaction beyond the initial authentication, making automated exploitation feasible once credentials are obtained.

For technical details regarding exploitation mechanics, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-27044

Indicators of Compromise

Unexpected PHP files created in WordPress upload directories or plugin folders
Anomalous outbound network connections from the web server
Web server logs showing unusual POST requests to Total Poll Lite plugin endpoints
Modified plugin files or unexpected code injected into existing PHP files
New or unknown admin accounts created without authorization

Detection Strategies

Monitor WordPress plugin directories for unauthorized file modifications using file integrity monitoring
Implement web application firewall (WAF) rules to detect code injection attempts in plugin parameters
Review Apache/Nginx access logs for suspicious patterns targeting /wp-content/plugins/totalpoll-lite/ endpoints
Deploy endpoint detection and response (EDR) solutions to identify malicious process spawning from web server contexts

Monitoring Recommendations

Enable WordPress debug logging and monitor for PHP errors related to poll functionality
Configure SIEM alerts for successful code execution patterns originating from web application processes
Implement network traffic analysis to detect command-and-control communications from compromised servers
Schedule regular vulnerability scans targeting WordPress installations and plugins

How to Mitigate CVE-2026-27044

Immediate Actions Required

Audit all WordPress installations for the presence of Total Poll Lite plugin versions 4.12.0 and earlier
Consider temporarily deactivating the Total Poll Lite plugin until a patched version is available
Review user accounts and remove unnecessary low-privilege accounts that could be leveraged for exploitation
Implement web application firewall rules to block known code injection patterns
Check for indicators of compromise on systems running affected plugin versions

Patch Information

Organizations should monitor the Patchstack Vulnerability Report and the official TotalSuite vendor channels for patch availability. Update the Total Poll Lite plugin immediately when a security update becomes available.

Workarounds

Disable the Total Poll Lite plugin until a security patch is released
Restrict user registration and minimize the number of authenticated accounts on WordPress installations
Implement network-level access controls to limit administrative access to trusted IP ranges
Deploy a web application firewall with rules to detect and block code injection attempts
Consider migrating to an alternative polling plugin that is not affected by this vulnerability

bash

# WordPress CLI commands for mitigation
# Deactivate the vulnerable plugin
wp plugin deactivate totalpoll-lite --path=/var/www/html/wordpress

# List all users to audit accounts
wp user list --path=/var/www/html/wordpress

# Check plugin version
wp plugin get totalpoll-lite --path=/var/www/html/wordpress