CVE-2026-85682 Overview
CVE-2026-85682 is an Origin Validation Error [CWE-346] in the YOP Poll plugin for WordPress affecting all versions up to and including 7.0.10. The plugin transmits a wp_rest nonce to window.opener via postMessage() using a wildcard targetOrigin. An unauthenticated attacker can harvest a REST nonce scoped to a logged-in Administrator and reuse it to change the Administrator's email address and password. Successful exploitation requires the Administrator to open an attacker-controlled page, resulting in full account takeover of the WordPress site.
Critical Impact
Unauthenticated attackers can steal an Administrator-scoped REST nonce and leverage it to hijack the account, taking complete control of the WordPress site.
Affected Products
- YOP Poll plugin for WordPress — all versions up to and including 7.0.10
- WordPress sites running YOP Poll with authenticated Administrator sessions
- Fixed in YOP Poll 7.0.11 and later
Discovery Timeline
- 2026-09-24 - CVE-2026-85682 published to the National Vulnerability Database
- 2026-09-24 - Last updated in the NVD database
Technical Details for CVE-2026-85682
Vulnerability Analysis
The YOP Poll plugin uses the browser postMessage() API to communicate between a popup window and its opener. When sending the message, the plugin specifies * as the targetOrigin, which instructs the browser to deliver the payload to any origin currently loaded in window.opener.
The payload includes a wp_rest nonce bound to the currently authenticated user. If that user is an Administrator, the nonce authorizes privileged REST API operations, including profile updates via the /wp/v2/users/me endpoint. An attacker who controls the opener page receives the nonce and immediately issues REST requests to overwrite the Administrator's email and password.
Because user interaction is required, the attack typically relies on social engineering. The Administrator must open a link to an attacker-controlled page that programmatically opens the vulnerable YOP Poll endpoint in a popup.
Root Cause
The root cause is improper validation of the message recipient's origin. Specifying * as the targetOrigin argument to postMessage() disables origin enforcement, allowing any cross-origin document loaded in window.opener to receive sensitive data. The nonce should only be transmitted to a known, trusted origin matching the WordPress site.
Attack Vector
The attacker hosts a malicious page that opens the vulnerable YOP Poll flow via window.open(). When the plugin posts the nonce back to the opener with a wildcard target, the attacker's script receives it. The attacker then issues cross-origin REST calls authenticated with the stolen nonce to update Administrator credentials. See the Wordfence Vulnerability Report and the WordPress Plugin Change Log for technical details.
Detection Methods for CVE-2026-85682
Indicators of Compromise
- Unexpected changes to Administrator email addresses or password hashes in the wp_users table.
- POST or PUT requests to /wp-json/wp/v2/users/me originating from unusual referrers or IPs.
- WordPress audit log entries showing profile updates immediately following access to YOP Poll endpoints.
- Outbound links in email, chat, or forum posts pointing to pages that open the WordPress site in popups.
Detection Strategies
- Inspect installed plugin versions and flag YOP Poll installations at or below 7.0.10.
- Monitor web server access logs for sequential requests to YOP Poll resources followed by REST API user updates from the same session.
- Alert on REST API requests to /wp/v2/users/me where the Origin or Referer header does not match the WordPress site origin.
Monitoring Recommendations
- Enable WordPress audit logging to capture user profile and password changes with timestamps and source IPs.
- Forward WordPress and web server logs to a centralized SIEM for correlation of nonce usage and credential changes.
- Review Administrator account activity on a recurring basis and investigate any email changes that lack a corresponding support ticket.
How to Mitigate CVE-2026-85682
Immediate Actions Required
- Update the YOP Poll plugin to a version newer than 7.0.10 as soon as the vendor patch is deployed on affected sites.
- Reset passwords and verify email addresses for all WordPress Administrator accounts.
- Audit recent REST API activity for unauthorized profile modifications.
- Instruct Administrators to avoid opening untrusted links while authenticated to WordPress.
Patch Information
The vendor remediation is tracked in the WordPress Plugin Change Log. The fix replaces the wildcard targetOrigin in the postMessage() call with the WordPress site origin, preventing cross-origin recipients from receiving the REST nonce.
Workarounds
- Deactivate and remove the YOP Poll plugin until a patched version is installed.
- Restrict Administrator sessions to dedicated browsers or profiles not used for general browsing.
- Enforce multi-factor authentication on all Administrator accounts to limit the impact of credential changes.
- Deploy a web application firewall rule to block REST requests to /wp/v2/users/me from non-site origins.
# Example WordPress CLI commands to inventory and remove the vulnerable plugin
wp plugin list --name=yop-poll --fields=name,version,status
wp plugin deactivate yop-poll
wp plugin update yop-poll
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.