CVE-2026-14840
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forward
CVSS
5.3
Medio
EPSS
0.1%
p4
KEV
—
Exploit Today
1
0-100
Publicado: 1 ago 2026 · Última mod.: 5 ago 2026 · CWE-290
0.1%EPSS · 30 días0.1%
2026-08-012026-08-05
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-646658.1 ALT—
———Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0.2hCVE-2026-655708.1 ALT—
———Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.2hCVE-2026-655025.3 MED—
———Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.2hCVE-2026-324695.3 MED—
———Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.8hCVE-2026-48063—5.3%
——2Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync. This issue has been fixed in versions 6.7.22 and 7.0.0-rc12.2dCVE-2026-288129.8 CRÍ23.6%
——7UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges.
Users are recommended to upgrade to version 2.12.4 or newer which fixes this issue.1d