Voting Limit Bypass in YOP Poll Plugin via X-Forwarded-For Spoofing

CVE-2026-14840 affects the YOP Poll plugin (version 7.0.5) for WordPress, enabling unauthorized manipulation of poll results. The vulnerability arises from improper validation of the client's IP address when determining voting eligibility. An attacker can bypass per-IP rate limiting by injecting arbitrary IP addresses into the X-Forwarded-For HTTP header, causing the application to treat each request as originating from a unique, previously uncounted user. This vulnerability allows for the automated submission of multiple votes, potentially skewing public perception or poll outcomes. A functional proof-of-concept exploit was released on 2026-08-13, significantly lowering the barrier for exploitation. Defenders should monitor for anomalous spikes in voting activity from single sources and validate IP-based restrictions against header-based spoofing.

Attack Chain

1. Attacker identifies a target website utilizing the YOP Poll WordPress plugin version 7.0.5.
2. Attacker inspects the polling mechanism to determine the endpoint processing vote submissions.
3. Attacker crafts a series of HTTP POST requests directed at the poll submission endpoint.
4. Attacker inserts a custom 'X-Forwarded-For' header in each request with unique or spoofed IP address values.
5. The YOP Poll plugin processes the request and incorrectly trusts the 'X-Forwarded-For' value over the source IP for rate-limiting checks.
6. The backend database, 'wp_yoppoll_votes', records each request as a legitimate vote from a new user.
7. Attacker repeats the process to accumulate a large number of votes, effectively rigging the poll results.

Impact

Successful exploitation allows an attacker to bypass business logic controls, leading to the integrity compromise of poll results. While the impact is primarily service-level manipulation rather than data exfiltration or system compromise, it directly affects the trustworthiness of user engagement features deployed across WordPress websites. Organizations relying on this plugin for public sentiment analysis or high-stakes voting should consider the risk of automated manipulation.

Recommendation

• Implement request logging for the 'X-Forwarded-For' header in web application firewalls or load balancers to detect irregular patterns of IP rotation.
• Patch the YOP Poll plugin to the latest version as soon as a fix is available from the vendor.
• Review web server configurations to ensure that 'X-Forwarded-For' headers are sanitized or trusted only from verified proxy ranges.