CVE-2023-6109: YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-14 · updated 2026-06-17
Weakness: CWE-362

Description

The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the add() function. This makes it possible for unauthenticated attackers to place multiple votes on a single poll even when the poll is set to one vote per person.

Affected products

YOP Poll: through 6.5.26

References

https://plugins.trac.wordpress.org/changeset/2959124/yop-poll/trunk/admin/models/votes.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/360b1927-a863-46be-ad11-3f6251c75a3c?source=cve
https://plugins.trac.wordpress.org/changeset/2959124/yop-poll/trunk/admin/models/votes.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/360b1927-a863-46be-ad11-3f6251c75a3c?source=cve

Get alerted when CVE-2023-6109 or the next vulnerability affects your stack