{"id":"CVE-2026-14840","title":"The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to byp…","summary":"The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to byp…","severity":"none","published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-14840","references":[{"url":"https://wpscan.com/vulnerability/fc810ca2-3f27-414d-b94a-68842925b7c6/","label":"contact@wpscan.com"}],"tags":["nvd","exploit-available"],"epss":0.00222,"epssPercentile":0.1295,"ingestedAt":"2026-08-02T05:17:47.427Z","exploits":{"github":1,"githubRepos":["https://github.com/nullwhisper/CVE-2026-14840"],"checkedAt":"2026-09-21T15:28:03.678Z"},"exploitAvailable":true,"slug":"CVE-2026-14840","body":"## Overview\n\nThe YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":15,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":4958,"id":"CVE-2026-14840","ts":1788887219759,"field":"exploit_available","old":"false","new":"true"},{"seq":3841,"id":"CVE-2026-14840","ts":1788886352387,"field":"exploit_available","old":"true","new":"false"},{"seq":2675,"id":"CVE-2026-14840","ts":1788883017047,"field":"exploit_available","old":"false","new":"true"},{"seq":1704,"id":"CVE-2026-14840","ts":1788882421575,"field":"exploit_available","old":"true","new":"false"},{"seq":811,"id":"CVE-2026-14840","ts":1788881855444,"field":"exploit_available","old":"false","new":"true"}]}