CVE-2026-85682: YOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route
The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wprest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to account takeover?
Sites using YOP Poll version 7.0.10 or earlier are affected. Exploitation specifically requires a logged-in WordPress Administrator to open an attacker-controlled page.
Does an attacker need a WordPress account or administrator credentials?
No. The attacker can be unauthenticated, but must induce a logged-in Administrator to visit a page under the attacker’s control.
What can an attacker do after successful exploitation?
The attacker can obtain a REST nonce associated with the logged-in Administrator and use it to change that Administrator’s email address and password, resulting in full account takeover.
What is the relevant exposure path for detection or investigation?
The affected behavior involves the /auth/wp-login-redirect REST route transmitting a wp_rest nonce to window.opener through postMessage() using a wildcard targetOrigin. Investigations should focus on whether an Administrator opened untrusted pages while logged in and whether administrator email or password changes occurred.