CVE-2023-6109

CWE-362 — Race Condition4 documents4 sources
Severity
3.7LOW
EPSS
0.2%
top 56.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Yourownprogrammer YOP PollYop-poll YOP Poll
Timeline
PublishedNov 14
Latest updateApr 11

Description

The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the add() function. This makes it possible for unauthenticated attackers to place multiple votes on a single poll even when the poll is set to one vote per person.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages2 packages

▶NVDyop-poll/yop_poll6.5.26
▶CVEListV5yourownprogrammer/yop_poll6.5.26

Patches

Patch: plugins.trac.wordpress.org ↗Patch: plugins.trac.wordpress.org ↗

🔴Vulnerability Details

3
VulDB
YOP Poll Plugin up to 6.5.26 on WordPress Vote race condition (ID 2959124)↗2026-04-11
▶
CVEList
YOP Poll <= 6.5.26 - Race Condition to Vote Manipulation↗2023-11-14
▶
GHSA
GHSA-pgj2-fwxq-v5vr: The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6↗2023-11-14
▶
CVE-2023-6109 (LOW CVSS 3.7) | The YOP Poll plugin for WordPress i | cvebase.io