The Poll Maker plug‑in’s ays_poll_get_user_information AJAX action lacks proper access controls, returning the full WP_User object, including password hashes and personal data, to any authenticated user with subscriber privileges. This results in a sensitive information exposure vulnerability (CWE‑200) that allows attackers to harvest password hashes and other personal details from their own or other subscriber accounts. The disclosed data can then be used for offline password‑cracking or reconnaissance.

WordPress sites running the Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls plug‑in with a version of 6.3.7 or earlier are affected. Versions 6.3.8 and above have the vulnerability addressed and are not impacted.

The CVSS score of 4.3 indicates moderate severity. No EPSS or KEV data is available, suggesting no widespread exploitation has been observed. Attackers must already be authenticated, but subscriber roles are common, so the attack surface is considerable. Although no public exploit exists, the exposed password hashes can be used for serious offline attacks, so the risk warrants priority remediation.