Vulnerability · Published Nov 21, 2022 · Assigned by WPScan
CVE-2022-1581WP-Polls < 2.76.0 - IP Validation Bypass
Medium 5.3
In plain English
A medium-severity security flaw in WP-Polls from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 46.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
Affected products (as reported)
References
- https://wpscan.com/vulnerability/c1896ab9-9585-40e2-abbf-ef5153b3c6b2 exploit, vdb-entry, technical-description
- https://www.hightechdad.com/2009/12/21/warning-wp-polls-wordpress-poll-plugin-can-be-exploited/