Account Takeover via Origin Validation Error in YOP Poll WordPress Plugin

The YOP Poll plugin for WordPress is vulnerable to an origin validation error (CVE-2026-85682) in all versions up to and including 7.0.10. The vulnerability stems from the plugin's improper use of the postMessage() API, which transmits a wp_rest nonce to the window.opener object using a wildcard targetOrigin. By exploiting this, an unauthenticated attacker can orchestrate a cross-origin attack against a logged-in Administrator. If an Administrator is induced to visit an attacker-controlled website, the attacker can intercept the transmitted nonce. With this REST nonce, the attacker gains the ability to make authenticated requests on behalf of the Administrator, specifically allowing them to modify administrative credentials, change the associated email address, and achieve a full account takeover of the WordPress instance. This vulnerability highlights the risks associated with improper cross-window communication in web plugins.

Attack Chain

1. Attacker hosts a malicious webpage containing a crafted JavaScript payload.
2. Attacker crafts a phishing campaign or uses social engineering to lure an authenticated WordPress Administrator to the malicious webpage.
3. The malicious webpage opens a new window or tab pointing to the target WordPress site's YOP Poll component.
4. The YOP Poll plugin executes, sending a message containing the sensitive 'wp_rest' nonce via postMessage() to the opener.
5. The attacker's malicious script intercepts the window.opener.postMessage event due to the wildcard origin configuration.
6. Attacker extracts the valid 'wp_rest' nonce from the message object.
7. Attacker uses the stolen nonce to authenticate REST API calls directed at the WordPress backend.
8. Attacker updates the Administrator's user profile, changing the email address and password to finalize account takeover.

Impact

Successful exploitation allows for full administrative account takeover. This gives the attacker complete control over the WordPress instance, enabling them to modify content, install malicious plugins, exfiltrate database contents, or deploy additional malware. The scope is limited to WordPress installations utilizing YOP Poll version 7.0.10 or earlier.

Recommendation

Prioritize the remediation of CVE-2026-85682 by updating the YOP Poll plugin to the latest version patched by the vendor. Ensure that administrative users are encouraged to maintain session hygiene and avoid navigating to untrusted external sites while holding an active, elevated session in the WordPress dashboard.