Description

The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-24T09:17:08.797Z",
  "pubdate": "2026-09-24T09:17:08.797Z",
  "executiveSummary": "The YOP Poll WordPress plugin, in versions 7.0.10 and earlier, is susceptible to an Origin Validation Error vulnerability.\nThis security flaw facilitates a Cross-Origin Message exploitation, enabling unauthenticated remote attackers to intercept a sensitive wp_rest nonce.\nBy capturing this nonce, an attacker can perform unauthorized actions on behalf of a logged-in Administrator, including modifying account credentials and email addresses.\nThe vulnerability is contingent upon an Administrator visiting a malicious, attacker-controlled website while logged into the vulnerable WordPress environment.\nSuccessful exploitation results in a complete site takeover, as the intercepted nonce bypasses security controls intended to protect REST API requests.\nGiven the severity of the outcome, this vulnerability poses a critical risk to the integrity and administrative control of affected WordPress installations.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of the window.opener.postMessage() API within the YOP Poll plugin. The application transmits a valid wp_rest nonce to the window.opener object without specifying a restricted targetOrigin, utilizing a wildcard (*) instead.\nThis behavior violates the Same-Origin Policy (SOP) by broadcasting sensitive authentication tokens to any window that spawned the current context, regardless of origin. In a typical attack scenario, an attacker hosts a malicious web page and lures a logged-in Administrator to visit it. The malicious page then opens a window or iframe leading to a legitimate page on the WordPress site that leverages the vulnerable YOP Poll plugin functionality.\nUpon loading, the vulnerable script inside the plugin triggers a postMessage() call, dispatching the active wp_rest nonce to the opener window. The attacker’s page, which maintains a reference to the opened window, listens for this message via an event listener. Once the message is received, the attacker extracts the wp_rest nonce from the event data.\nWith the stolen nonce, the attacker can then craft authenticated requests to the WordPress REST API. Because the nonce is scoped to the Administrator’s session, these requests are treated as authorized by the server. The attacker can subsequently invoke API endpoints responsible for user management, specifically those allowing for the modification of administrative email addresses and password resets.\nBy altering the administrative email to an attacker-controlled address, the adversary can initiate a password reset flow, effectively seizing full control of the WordPress instance. This vulnerability bypasses traditional CSRF protections because the nonce provides the necessary cryptographic authorization required to validate requests as legitimate user intents. The affected versions include all releases up to and including 7.0.10, and the exploit requires no prior authentication from the attacker's perspective, relying entirely on the Administrator’s active session and the social engineering of the victim."
}