CVE-2026-85682: YOP Poll WordPress Auth Bypass Vulnerability

CVE-2026-85682 Overview

The YOP Poll plugin for WordPress contains an origin validation flaw affecting all versions up to and including 7.0.10. The plugin transmits a wp_rest nonce to window.opener through postMessage() using a wildcard targetOrigin value. This design allows an unauthenticated attacker to capture a REST nonce scoped to a logged-in Administrator session. Attackers can then use the stolen nonce to change the Administrator's email address and password, resulting in full account takeover. Exploitation requires the Administrator to open an attacker-controlled page. The weakness is classified under CWE-346: Origin Validation Error.

Critical Impact
Successful exploitation grants an unauthenticated remote attacker complete Administrator control over the affected WordPress site, including full site defacement, plugin installation, and lateral movement opportunities.

Affected Products

YOP Poll plugin for WordPress, all versions through 7.0.10
WordPress sites with an authenticated Administrator session active during exploitation
Any WordPress deployment where Administrators may browse untrusted external pages

Discovery Timeline

2026-09-24 - CVE-2026-85682 published to the National Vulnerability Database
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-85682

Vulnerability Analysis

The vulnerability originates in how the YOP Poll plugin exchanges data between a popup window and its opener. The plugin invokes window.opener.postMessage() with a wildcard * as the targetOrigin argument. The wildcard instructs the browser to deliver the message to whatever origin currently occupies the opener window, regardless of intent.

Because the transmitted payload contains a valid wp_rest nonce bound to the current Administrator session, any page that opened the plugin URL receives cryptographic material authorized to call WordPress REST endpoints. Attackers can then invoke the user profile update endpoint to overwrite the Administrator email and password without knowing the original credentials.

The attack chain requires user interaction from a privileged victim, but the interaction can be as minimal as clicking a link. Once the Administrator opens the attacker's page, exploitation completes silently in the background using standard fetch requests carrying the stolen nonce.

Root Cause

The root cause is improper origin validation in cross-window messaging. Secure postMessage() usage requires a specific targetOrigin string that matches the intended recipient. Passing * disables the browser's origin-scoping protection and treats any listener as trusted.

Attack Vector

An attacker hosts a malicious page that opens a URL on the target WordPress site containing the vulnerable YOP Poll functionality. The victim Administrator must visit this attacker page while authenticated. The attacker's page registers a message event handler, receives the nonce from the opened window, and issues authenticated REST API calls to /wp-json/wp/v2/users/me to modify the Administrator's email and password.

Detailed proof-of-concept information is available in the Wordfence Vulnerability Report and the corresponding fix is documented in the WordPress Trac Changeset.

Detection Methods for CVE-2026-85682

Indicators of Compromise

Unexpected changes to Administrator account email addresses or password hashes in the wp_users table
WordPress audit log entries showing profile updates originating from unusual referrers or IP addresses
Outbound requests from Administrator browsers to unknown domains immediately preceding account modifications
Password reset notification emails delivered to Administrators who did not initiate a change

Detection Strategies

Inspect web server access logs for POST and PUT requests to /wp-json/wp/v2/users/ endpoints correlated with recent Administrator sessions
Monitor WordPress site for installations of the YOP Poll plugin at versions 7.0.10 or below
Correlate wp_rest nonce issuance with subsequent REST API calls originating from mismatched Referer headers

Monitoring Recommendations

Enable a WordPress activity log plugin to record user profile changes and authentication events
Alert on any modification to Administrator email addresses or password hashes outside change-management windows
Track browser telemetry from privileged users for navigation to unexpected external domains during administrative sessions

How to Mitigate CVE-2026-85682

Immediate Actions Required

Update the YOP Poll plugin to a version above 7.0.10 that contains the patched postMessage() call
Force a password reset for all Administrator accounts on affected WordPress installations
Review recent Administrator account changes and revert any unauthorized email or password updates
Audit installed plugins and remove YOP Poll if it is not required for site functionality

Patch Information

The vendor addressed the flaw by replacing the wildcard targetOrigin argument with an explicit origin value in the plugin's postMessage() invocation. The corrective code is published in the WordPress Trac Changeset 3690945. Site operators should apply the update through the WordPress plugin management interface or WP-CLI.

Workarounds

Deactivate and remove the YOP Poll plugin until the patched version is deployed
Restrict Administrator browsing to trusted sites and use a separate browser profile for WordPress administration
Deploy a web application firewall rule to block unauthorized POST requests to /wp-json/wp/v2/users/me from unexpected origins
Require multi-factor authentication for all Administrator accounts to reduce single-factor takeover impact

bash

# Update the YOP Poll plugin using WP-CLI
wp plugin update yop-poll

# Verify installed version is above 7.0.10
wp plugin get yop-poll --field=version

# If patching is delayed, deactivate the plugin
wp plugin deactivate yop-poll