WordPress Plugin Vulnerabilities

YOP Poll < 6.5.29 - Reusable Captcha via validateImage

Description

The YOP Poll plugin for WordPress is vulnerable to captcha bypass due to a reusable captcha bypass in the validateImage function in all versions up to, and including, 6.5.28. This makes it possible for unauthenticated attackers to vote multiple times using the same captcha image

Affects Plugins

Plugin icon
yop-poll
Fixed in 6.5.29

References

CVE
CVE-2023-46611
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/33f8f75d-c57e-456c-a48a-82fa668adb1c

Miscellaneous

Original Researcher
qilin_99
Verified
No
WPVDB ID
76893a78-7a38-4b46-8c49-5a83230d6c41

Timeline

Publicly Published
2023-10-24 (about 6 months ago)
Added
2023-11-23 (about 5 months ago)
Last Updated
2023-11-24 (about 5 months ago)

Other

Published
Title
Published
2019-04-24
Title
WP Database Backup < 5.2 - Unauthenticated OS Command Injection
Published
2015-11-11
Title
BuddyPress <= 2.3.4 - Authenticated Privilege Escalation
Published
2021-08-19
Title
WP Cerber Security < 8.9.3 - Rest-API Protection Bypass
Published
2016-04-01
Title
Stop User Enumeration <= 1.3.3 - Username Enumeration Bypass
Published
2019-09-24
Title
Rich Reviews < 1.8.0 - Unauthenticated Plugin Options Update