The YOP Poll plugin for WordPress contains an unvalidated Origin error that allows an unauthenticated user to retrieve a wp_rest nonce via postMessage() with a wildcard targetOrigin. By obtaining this nonce, an attacker can impersonate a logged‑in Administrator and modify the Administrator's email address and password through the /auth/wp-login-redirect REST route, effectively taking over the Administrator account. The weakness is identified as CWE‑346.

The vulnerability affects all versions of the YOP Poll plugin for WordPress up to and including 7.0.10. Users running any of these releases should verify their plugin version and apply the latest fix.

The CVSS score of 8.8 indicates a high‑severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the Administrator to visit an attacker‑controlled site, after which the attacker can steal the REST nonce and use it to change credentials. The attack vector is indirect via a cross‑origin postMessage, but it involves an authenticated target (Administrator) and is therefore not a remote code execution in the traditional sense. The risk for organizations with missing patches is high, especially if administrators frequently browse external sites.