CVE-2026-14840— YOP Poll 授权问题漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-14840の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing
ソース: CVE Program / CVE List V5
脆弱性説明
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
N/A
ソース: CVE Program / CVE List V5
脆弱性タイトル
YOP Poll 授权问题漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
YOP Poll是yop-poll个人开发者开源的一个在线投票插件。 YOP Poll 7.0.6之前版本存在授权问题漏洞，该漏洞源于未验证连接来源IP地址，而是信任客户端控制的转发头，可能导致未经身份验证的攻击者绕过投票限制，在公开投票中投出无限票。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2026-14840の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-14840のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-14840 新闻报道 (1)
- 🔗 YOP Poll < 7.0.6 – Unauthenticated Vote Restriction Bypass via IP Header Spoofing | CVE 2026-14840 | Plugin Vulnerabilities 記事全文を読む exploitvdb-entrytechnical-description
Same Patch Batch · Unknown · 2026-08-01 · 30 CVEs total
| CVE-2026-13604 | Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX | |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | |
| CVE-2026-12966 | Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering v | |
| CVE-2026-15932 | Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal | |
| CVE-2026-14309 | Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass | |
| CVE-2026-14596 | DynamicKit for Elementor < 1.0.3 - Unauthenticated Account Takeover via Password Reset Lin | |
| CVE-2026-14836 | Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limi | |
| CVE-2026-14197 | Fluent Support < 2.3.1 - Agent+ Arbitrary Ticket Customer Reassignment via IDOR | |
| CVE-2026-15244 | HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File In | |
| CVE-2026-15368 | Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registrat | |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | |
| CVE-2026-15262 | Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column | |
| CVE-2026-13157 | Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-13158 | Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload | |
| CVE-2026-10827 | Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via B | |
| CVE-2026-14561 | Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP | |
| CVE-2026-13596 | Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search | |
| CVE-2026-13329 | WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund | |
| CVE-2026-12696 | wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field | |
| CVE-2026-11882 | Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public |
Showing 20 of 30 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: YOP Poll
- CVE-2025-64370
WordPress YOP Poll plugin <= 6.5.38 - Broken Access Control - CVE-2025-62040
WordPress YOP Poll plugin <= 6.5.37 - Cross Site Scripting ( - CVE-2023-46611
WordPress YOP Poll plugin <= 6.5.28 - Vote Manipulation Due - CVE-2023-6109
YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation - CVE-2022-1600
YOP Poll < 6.4.3 - IP Spoofing
同じベンダー: Unknown
- CVE-2026-16296
Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler - CVE-2026-16546
Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbi - CVE-2026-16295
Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosu - CVE-2026-16547
REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Di - CVE-2026-16548
Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload v
V. CVE-2026-14840へのコメント
まだコメントはありません