YOP Poll
YOP Poll 7.0.10 and earlier can expose an administrator REST nonce through unsafe postMessage origin handling. Update to 7.0.11 or later and review administrator accounts.
YOP Poll 7.0.10 and earlier is vulnerable to administrator account takeover because a REST nonce can be sent to an untrusted window through unsafe postMessage() origin handling. The issue is CVE-2026-85682, rated CVSS 8.8 High. Update to 7.0.11 or later; WordPress.org currently offers 7.0.12.
Impact and prerequisites
- Plugin: YOP Poll (
yop-poll) - Affected versions: 7.0.10 and earlier
- Privilege required: None for the attacker
- User interaction: A logged-in administrator must open an attacker-controlled page
- Impact: Theft of an administrator-scoped REST nonce, followed by account email/password changes and administrator account takeover
- Fixed version: 7.0.11; install the latest available release
The Wordfence disclosure explains that the plugin sends a wp_rest nonce to window.opener using a wildcard targetOrigin. A malicious page opened by an authenticated administrator can therefore receive the nonce and use the administrator’s REST authorization context. The required administrator interaction lowers automatic mass-exploitation potential, but successful abuse can still produce complete site takeover.
Immediate remediation
- Update YOP Poll to 7.0.11 or later. The current WordPress.org version is 7.0.12.
- Until patched, deactivate YOP Poll and avoid opening untrusted links while authenticated as a WordPress administrator.
- After patching, sign out all administrator sessions if suspicious activity is suspected, then rotate affected administrator passwords and enable multi-factor authentication.
- Review administrator email addresses and account creation dates for unauthorized changes.
wp plugin get yop-poll --fields=name,status,version,update --format=table
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered --format=tableVerification and incident checks
Check access and application logs for requests to the YOP Poll /auth/wp-login-redirect REST route and unusual REST activity tied to administrator sessions. Review password-reset events, changes to administrator email addresses, newly created users, plugin installations, must-use plugins, and scheduled tasks. Preserve logs before changing account data when compromise is suspected.
Do not attempt to reproduce the nonce theft against a production administrator session. Updating and reviewing account state are the appropriate defensive actions.
Sources
