WordPress CP Polls 1.0.8 Cross-Site Request Forgery

Published 4 mo ago 2026-06-15 · modified 4 mo ago 2026-06-17 · JSON

CVSS

4.3

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.1%

percentile 1%

Public exploits

none known

WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when administrators visit the page while logged in.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 4 mo ago 2026-06-15

Exploit prediction (EPSS)

0.11% probability of exploitation in the next 30 days, higher than 1% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	5.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`
CNA	3.1	4.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`
CNA	4.0	5.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	4.3	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Affected products

dwbooster CP Polls

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

exploit-db.com /exploits/39513 · exploit
vulncheck.com /advisories/wordpress-cp-polls-cross-site-request-forgery · third-party-advisory

Sources

CVE List: CVE-2016-20067
NVD: CVE-2016-20067

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary