The vulnerability is a missing authorization issue that enables exploitation of incorrectly configured access control security levels in TotalSuite’s Total Poll Lite plugin for WordPress. As a result, an attacker may read or modify poll data and settings that should be restricted to authorized users. This breach is classified as CWE‑862, indicating broken access control.

The affected product is TotalSuite’s Total Poll Lite, impacting all releases from the initial version up to and including 4.12.0. WordPress sites that have this plugin installed and are running a version no newer than 4.12.0 are vulnerable.

The CVSS score of 6.3 denotes a moderate severity. The EPSS score is below 1%, indicating a low probability of exploitation at present. It is not listed in the CISA KEV catalog, suggesting no known high‑profile exploitation. Based on the description, it is inferred that the attacker could target the plugin’s administrative endpoints through the WordPress interface; however, the exact conditions required for exploitation are not detailed in the advisory.