Vulnerability · Published Aug 1, 2022 · Assigned by WPScan
CVE-2022-1600YOP Poll < 6.4.3 - IP Spoofing
Medium 5.3
In plain English
A medium-severity authorization bypass via user-controlled key in YOP Poll from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)0.8%top 43.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
Affected products (as reported)
Weakness: CWE-639