The YOP Poll WordPress plugin, versions prior to 7.0.6, fails to verify the origin IP address of a client connection and instead honors client‑controlled forwarding headers when enforcing the per‑IP vote limit. An unauthenticated attacker can set arbitrary IP headers, bypass the vote restriction, and cast unlimited votes on a public poll, thereby corrupting the poll data and eroding its integrity.

WordPress sites that have installed the YOP Poll plugin in any version below 7.0.6. The vendor or product name is listed as Unknown:YOP Poll in the CNAs. No specific release notes are available, but any deployment of the plugin prior to 7.0.6 is vulnerable.

The EPSS score is less than 1% and the vulnerability is not currently listed in the CISA KEV catalog, indicating that the likelihood of widespread exploitation is low. The attack requires only the ability to send HTTP requests with forged forwarding headers, which can be achieved from any remote host or via script. Because no authentication is required, the risk to poll integrity is significant for any site that relies on accurate results. The CVSS score of 5.3 indicates a moderate severity, underscoring the importance of addressing the vulnerability.