CVE-2026-14840

MEDIUM

YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-14840 has a selected CVSS score of 5.3 (medium); EIP currently links 1 repository PoC and 1 lab environment.

Description

The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 5, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

YOP Poll

Default status: unaffected

CVE List7.0.0 to < 7.0.6affected

Proofs of concept

1

Repository PoCs

GitHubnullwhisper/CVE-2026-14840Repository PoCby nullwhisper0Exploit6 files

13.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that exploits CVE-2026-14840 by sending multiple votes with spoofed X-Forwarded-For IPs to bypass per-IP vote restrictions in the YOP Poll WordPress plugin.

Backdoor review

No backdoor observed in reviewed code

The PoC script cve_2026_14840_poc.py performs exactly the disclosed exploit: it sends POST requests to a target WordPress site's YOP Poll REST API endpoint with a spoofed X-Forwarded-For header to bypass per-IP vote limits. No hidden, deceptive, or unrelated harmful behavior is present. The script's actions are limited to the operator-specified target, and all network communication is directly tied to the vote-casting functionality.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareYOP Poll WordPress plugin
Attack typesAuthentication Bypass by Spoofing
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends crafted requests to cast multiple votes, which is the exploitation of the vulnerability, not just detection. It is described as a 'PoC' and its main purpose is to demonstrate the bypass by successfully casting votes.

cve_2026_14840_poc.py:1-15cve_2026_14840_poc.py:143-145

Requirements

  • Target must have a page containing a YOP Poll with the vulnerable plugin version (< 7.0.6).README.md:8-12
  • The attacker must be able to send HTTP requests to the target WordPress site.cve_2026_14840_poc.py:38

Observed behavior

  • Fetches a target page and extracts poll ID, nonce, and answer IDs from embedded JSON.cve_2026_14840_poc.py:35-67
  • Sends multiple POST requests to the YOP Poll REST API endpoint with a randomly generated IP in the X-Forwarded-For header.cve_2026_14840_poc.py:70-111
  • Reports the target as vulnerable if more than one vote is accepted.cve_2026_14840_poc.py:165-167
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Endpoint
Payload withheldThe script sends vote-casting POST requests to these endpoints on the operator-specified target. This is the core of the disclosed exploit.cve_2026_14840_poc.py:92-95
Http Header
Payload withheldThe script sets a spoofed IP address in the X-Forwarded-For header for each vote request, which is the mechanism for bypassing the per-IP vote restriction.cve_2026_14840_poc.py:89
Dependency
Payload withheldStandard Python HTTP libraries required to run the PoC. No unusual or suspicious dependencies are included.requirements.txt:1-2
Review boundaries

What the analysis did not establish

  • The lab setup files (docker-compose.yml, setup.php) are not included in the text evidence, so the full lab environment cannot be analyzed.
  • The evidence does not include the vulnerable plugin binary, so the exact vulnerable code path cannot be verified.
  • Three files (lab/docker-compose.yml, lab/setup.php, and the .gitignore) were not included in the text evidence, but their omission is not material to the backdoor review as they are described as lab setup files and the primary executable PoC script was fully provided.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

lab/docker-compose.yml

nullwhisper/CVE-2026-14840Created Vuln labCVE-2026-14840Compose · images

1 Compose manifest · 3 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for a WordPress site with a vulnerable YOP Poll plugin, designed to demonstrate CVE-2026-14840, a vote-limit bypass. It includes a MySQL database, a WordPress web server, and a WP-CLI container for setup.

lab/docker-compose.yml:1-52README.md:1-126

Lab assessment

Vulnerability lab

The README explicitly states the environment is for demonstrating CVE-2026-14840, a vote-limit bypass in the YOP Poll plugin. The Compose file sets up a WordPress instance with the vulnerable plugin mounted, and setup.php creates a poll for testing.

README.md:1-3README.md:5-12lab/docker-compose.yml:1-52
Lab shapeCompose · images
Services3
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MySQL 8.0 database service for WordPress. It stores WordPress data and the YOP Poll tables. Credentials are set via environment variables.

lab/docker-compose.yml:4-14

wordpress

web servervulnerable target

WordPress 6.8 with Apache, serving the site on host port 127.0.0.1:8090. The YOP Poll plugin is bind-mounted from ./yop-poll, making it the target for the vote-limit bypass exploit.

lab/docker-compose.yml:16-30README.md:5-12

wpcli

setup utility

WordPress CLI container that sleeps indefinitely. It is used to run setup.php via docker exec, which creates a poll and a public test page. It shares the WordPress volume and plugin mount.

lab/docker-compose.yml:32-46README.md:72-74
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-14840

Supported by supplied evidence

The README describes the vulnerability as a vote-limit bypass in YOP Poll < 7.0.6 due to trusting attacker-controlled headers. The lab mounts the vulnerable plugin and setup.php creates a poll configured to allow guest voting with IP-based blocking, which matches the described attack vector.

README.md:5-12lab/setup.php:14-20lab/docker-compose.yml:26-27
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Download the vulnerable YOP Poll plugin version 7.0.5 from WordPress.org and place it in lab/yop-poll.README.md:56-62
  • Start the lab with 'docker compose up -d' from the lab directory.README.md:66-68
  • Complete the WordPress installer at http://127.0.0.1:8090.README.md:70
  • Run 'docker exec -i lab-wpcli-1 php /tmp/setup.php' to create the poll and test page.README.md:72-74
  • Install Python dependencies from requirements.txt (requests and urllib3).README.md:40-42requirements.txt:1-2

Evidence-described exercise path

  1. Download and extract the vulnerable YOP Poll plugin into lab/yop-poll.README.md:56-62
  2. Start the Docker Compose lab.README.md:66-68
  3. Complete the WordPress installation via the web interface.README.md:70
  4. Execute setup.php in the wpcli container to create a poll and a public page with the poll shortcode.README.md:72-74
  5. Run the PoC script cve_2026_14840_poc.py against the local lab URL to cast multiple votes with spoofed IP headers.README.md:78-80
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own WordPress target. The setup script creates a poll and page within the lab. The PoC script (not included in the packet) is described as casting votes against the local lab. There are no bind mounts of host directories, no privileged mode, no host network, and no evidence of host compromise, persistence, or external communication beyond the documented exercise.

lab/docker-compose.yml:1-52lab/setup.php:1-104README.md:1-126
Review boundaries

What the analysis did not establish

  • The PoC script cve_2026_14840_poc.py is not included in the evidence packet, so its exact behavior cannot be verified.
  • The YOP Poll plugin binary is not included; the lab requires a separate download from WordPress.org.
  • The packet does not include the WordPress installation step details, which must be performed manually.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2