CVE-2026-8995: Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action
The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 6.3.7. This is due to insufficient access controls on the 'ayspollgetuserinformation' AJAX action, which serializes and returns the complete WPUser object — including the userpass (bcrypt password hash), useremail, userlogin, userregistered, roles, and all capabilities — without any nonce verification or capability check beyond isuserloggedin(). This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve sensitive account data including their own password hash, which WordPress does not expose through any of its standard interfaces and which can be leveraged for offline password-cracking attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Poll Maker by AYS (Poll Maker – Versus Polls, Anonymous Polls, Image Polls)to a version that resolves this vulnerability.Fixed in 6.3.7 - Configuration
Modify the plugin so the 'ays_poll_get_user_information' AJAX handler enforces nonce verification and checks an appropriate capability before serializing/returning any user data (the current logic relies only on is_user_logged_in() and lacks a nonce/capability check).
WordPress plugin: Poll Maker by AYS (Poll Maker – Versus Polls, Anonymous Polls, Image Polls) AJAX action permission for ays_poll_get_user_information = Require nonce verification and a capability check beyond is_user_logged_in()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8995?
The severity of CVE-2026-8995 is medium with a score of 4.3.
How do I fix CVE-2026-8995?
To fix CVE-2026-8995, update the Poll Maker plugin to version 6.3.8 or later.
What type of vulnerability is CVE-2026-8995?
CVE-2026-8995 is a Sensitive Information Exposure vulnerability due to insufficient access controls.
What software is affected by CVE-2026-8995?
CVE-2026-8995 affects the AYS Poll Maker plugin for WordPress, versions up to and including 6.3.7.
What can an attacker do with CVE-2026-8995?
An attacker can exploit CVE-2026-8995 to gain unauthorized access to sensitive user information.