The YOP Poll plugin for WordPress contains an origin validation vulnerability that allows unauthenticated attackers to hijack administrator accounts through cross-site scripting techniques.

This flaw involves an improper origin validation error, where the plugin transmits a sensitive REST nonce to a window.opener via postMessage() using a wildcard targetOrigin. An unauthenticated attacker can leverage this to steal the nonce from a logged-in administrator, subsequently modifying administrative credentials and achieving full account takeover.

Successful exploitation results in complete administrative compromise of the WordPress site. This leads to unauthorized access to sensitive data, potential site defacement, and the ability to execute arbitrary code or inject malicious content, causing significant reputational and operational damage. With a CVSS score of 8.8, this vulnerability is considered high severity and requires immediate attention to prevent total platform control.

Immediate Action: Update the YOP Poll plugin to the latest version available from the WordPress repository to ensure the origin validation flaw is patched.

Proactive Monitoring: Monitor WordPress administrative audit logs for unexpected changes to account email addresses, password reset requests, or new user creation events.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to block suspicious cross-origin requests or restrict administrative access to known, trusted IP addresses.

Public Exploit Available: Unknown.

The severity of this vulnerability, combined with the potential for total administrative takeover, necessitates an immediate update. Administrators should verify their plugin version and apply the vendor patch without delay to mitigate the risk of unauthorized account access.