CVE-2016-20067: WordPress CP Polls CSRF Vulnerability

Technical summary

CVE-2016-20067 is a CSRF vulnerability (CWE-352) in CP Polls 1.0.8 affecting WordPress installations. The vulnerability stems from insufficient request validation mechanisms in the plugin's poll operations. Attackers can construct malicious HTML pages containing hidden requests that execute when authenticated administrators visit the page. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates network-accessible exploitation requiring valid user privileges, low attack complexity, and user interaction limited to the administrator accessing the malicious page. The vulnerability is confined to integrity impact with no confidentiality or availability consequences.

Business impact

Compromise of poll data and site configuration represents the primary business risk. Attackers could modify poll questions, answers, or results, potentially undermining the credibility of site content or misleading users. For sites using polls for feedback collection or decision-making, manipulated results create data integrity problems. The attack requires no technical sophistication from the attacker's perspective—a simple malicious webpage suffices. However, impact is limited to authenticated administrative functionality, reducing the blast radius compared to unauthenticated vulnerabilities.

Affected systems

WordPress installations running CP Polls plugin version 1.0.8 are affected. WordPress multisite installations and single-site deployments are equally vulnerable. Any site administrator visiting a malicious webpage while logged into WordPress becomes a vector for exploitation. The vulnerability does not require specific WordPress versions or configurations; it affects all environments running the vulnerable plugin version.

Exploitability

Exploitation is straightforward but constrained. An attacker must craft a webpage containing CSRF payloads targeting poll operations (such as vote manipulation, poll creation, or configuration changes). The attack succeeds only when a site administrator visits the malicious page while authenticated to WordPress. No user interaction beyond normal browsing is required once the administrator lands on the attacker-controlled page. The low attack complexity and network accessibility make this practical for opportunistic attackers, though the requirement for administrator authentication limits the pool of viable targets compared to unauthenticated CSRF flaws.

Remediation

Immediate action: disable or remove CP Polls 1.0.8 from production environments until patched. Verify against the plugin vendor's repository or advisory to confirm patch availability and version numbers. If a patched version is available, update the plugin after testing in a staging environment. Longer-term: audit poll data for unauthorized modifications during the period the vulnerable version was active. Implement security headers (SameSite cookie attributes, Content-Security-Policy) to provide defense-in-depth against CSRF attacks across all plugins.

Patch guidance

Consult the official CP Polls plugin page on WordPress.org or the vendor's security advisory for current patch version numbers and release dates. Update via the WordPress admin dashboard once a patched version is confirmed available. If no patch is published, consider alternative polling plugins that maintain active security practices. After updating, verify the plugin version in Settings or via wp-cli to confirm successful deployment.

Detection guidance

Monitor WordPress admin logs and audit tables for unusual poll-related operations occurring without corresponding administrator actions in session logs. Look for vote changes or poll modifications timestamped when admins were browsing external sites (difficult to correlate but valuable when reconstructing incidents). Implement WordPress security plugins that log CSRF attempts or failed nonce validations. Network-level detection is limited without deep inspection of WordPress session handling, but unusual patterns in poll data (votes not matching tracked user sessions) may indicate CSRF activity.

Why prioritize this

Although CVSS 3.1 assigns a MEDIUM severity of 4.3, prioritization should reflect the plugin's prevalence and the ease of weaponizing CSRF attacks at scale. Unlike remote code execution flaws, CSRF attacks are difficult to detect and can persist unnoticed. However, the requirement for administrator authentication significantly reduces urgency compared to unauthenticated vulnerabilities. Organizations should patch during normal maintenance windows but should not deprioritize other work. The vulnerability is not in the KEV catalog, indicating no evidence of active in-the-wild exploitation at the time of publication.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects the vulnerability's limited scope: integrity impact only (poll data manipulation), no confidentiality or availability loss, and attack complexity low. The requirement for authenticated user privileges (PR:L) prevents the score from climbing higher. User interaction is not required for exploitation once the admin visits the malicious page (UI:N is misleading here; it reflects that no additional clicks are needed beyond the initial navigation). The network vector (AV:N) acknowledges that the attack payload can originate remotely, though the admin's browser must be involved in the request.

Frequently asked questions