CVE-2026-8995: Poll Maker WordPress Plugin Sensitive Information Exposure – Password Hash Disclosure

Technical summary

CVE-2026-8995 exploits insufficient access controls in the 'ays_poll_get_user_information' AJAX action within Poll Maker versions up to 6.3.7. The endpoint serializes and returns the complete WP_User object when called by any authenticated user, relying only on is_user_logged_in() for validation. It lacks both nonce verification and capability checks. The returned payload includes user_pass (bcrypt hash), user_email, user_login, user_registered, roles, and capabilities—data that WordPress ordinarily withholds from standard API queries. This represents CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), as the plugin exposes account secrets reserved by WordPress core.

Business impact

Organizations using Poll Maker risk user account metadata exposure across their WordPress instances. While CVSS 4.3 reflects limited direct impact, the real risk lies in credential compromise if password hashes are subjected to offline brute-force attacks. For multi-user sites, this creates a lateral-movement vector: lower-privileged users can enumerate and profile higher-privilege accounts. Data privacy concerns emerge if email addresses and registration histories are harvested at scale. The exposure also heightens compliance risk under GDPR and similar regulations if user data exfiltration is documented.

Affected systems

Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is affected in versions up to and including 6.3.7. The vulnerability requires WordPress to be installed and the plugin to be active. It is exploitable by any user account with subscriber-level access or higher, meaning contributor, author, editor, and administrator roles are all at risk of exposure. Multisite WordPress installations are also in scope if the plugin is activated.

Exploitability

Exploitation is straightforward for attackers with valid WordPress credentials. No user interaction is required beyond authenticating to the site; the AJAX endpoint is freely callable by any logged-in user. Network access is required (AV:N) but attacks can originate remotely. The attack complexity is low (AC:L) because no special conditions or race conditions must be triggered. Subscribers—often the least-privileged user tier—are sufficient to execute the attack. The vulnerability is unauthenticated in the practical sense that it requires only baseline login privileges, making it attractive to attackers who have compromised a low-privilege account or who operate on shared WordPress environments.

Remediation

Update Poll Maker to a patched version released after 6.3.7. Verify the exact patch version number against the plugin's official release notes or vendor advisory. As an immediate interim measure, disable the plugin or restrict user registration and access to trusted administrators only. Consider blocking the 'ays_poll_get_user_information' AJAX action at the WAF or application firewall level if available. WordPress administrators should audit user accounts for unauthorized access and monitor for signs of credential compromise.

Patch guidance

Patch your Poll Maker installation as soon as a version post-6.3.7 is released. Use the WordPress plugin dashboard to check for and apply available updates. Before patching production systems, test updates on a staging environment to ensure compatibility with other active plugins and customizations. After patching, verify the fix by confirming that the 'ays_poll_get_user_information' endpoint either no longer exposes the WP_User object or now includes proper nonce validation and capability checks. Check the vendor's advisory for any additional configuration changes or security recommendations.

Detection guidance

Monitor logs for repeated calls to the 'admin-ajax.php' endpoint with the parameter 'action=ays_poll_get_user_information', especially from low-privilege user accounts or from external IP ranges. Inspect for serialized WP_User objects in response payloads if you have HTTP logging in place. Set up alerts on user enumeration patterns—multiple AJAX calls from a single session in rapid succession targeting user data. Query WordPress user metadata for unusual access to the 'user_pass' field if your database logging supports it. Conduct regular permission audits to identify subscriber accounts that should not have login access.

Why prioritize this

Although CVSS 4.3 is moderate, prioritize this vulnerability for timely patching because it directly exposes password hashes—a foundational credential asset. Offline brute-force attacks against bcrypt hashes are computationally feasible with modern hardware, especially if weak passwords are used. The low barrier to exploitation (any subscriber can trigger it) and the lack of user interaction required elevate practical risk. Sites with guest or contractor accounts should patch urgently, as credential compromise at any privilege level can enable persistence or lateral movement. However, this is not an emergency patch if your user access controls are strictly managed.

Risk score, explained

CVSS 4.3 reflects a low confidentiality impact (C:L) with no integrity or availability loss. The score accounts for the requirement of prior authentication (PR:L) and a network-accessible vector (AV:N). The moderate severity balances the sensitivity of exposed data (password hashes, emails) against the limited scope (user's own account and profile data, not system-wide secrets). The actual business risk may exceed the numeric score if your organization has a large user base, relies on weak password policies, or operates in a regulated industry. Use this score as a floor for risk assessment, not a ceiling.

Frequently asked questions