CVE-2023-6109 in YOP Poll Plugin
Summary
by MITRE • 11/14/2023
The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the add() function. This makes it possible for unauthenticated attackers to place multiple votes on a single poll even when the poll is set to one vote per person.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/11/2026
The vulnerability identified as CVE-2023-6109 affects the YOP Poll plugin for WordPress, representing a critical race condition flaw that undermines the fundamental integrity of polling mechanisms. This vulnerability exists in all versions up to and including 6.5.26, making it a widespread concern for WordPress sites utilizing this polling solution. The race condition manifests specifically within the add() function of the plugin, which fails to implement proper concurrency controls, allowing attackers to exploit temporal gaps in the vote processing logic.
The technical implementation of this vulnerability stems from inadequate synchronization mechanisms within the plugin's core functionality. When multiple vote requests are processed simultaneously, the race condition allows unauthenticated attackers to bypass the intended one-vote-per-person restriction. This occurs because the plugin does not properly validate vote eligibility during concurrent access scenarios, creating opportunities for duplicate voting. The flaw operates at the application level, exploiting weaknesses in how the plugin manages state transitions and vote recording processes, effectively rendering the poll's integrity controls ineffective.
From an operational impact perspective, this vulnerability enables manipulation of poll results through straightforward exploitation techniques that require no authentication credentials. Attackers can flood the system with multiple simultaneous vote requests, potentially skewing poll outcomes significantly. The implications extend beyond simple result manipulation to include potential denial-of-service conditions where the polling system becomes overwhelmed with invalid entries. This vulnerability directly affects the trustworthiness of data collected through these polls, potentially compromising decision-making processes that rely on accurate voting data.
The vulnerability aligns with CWE-362, which describes a race condition in software systems, and represents a classic example of improper access control in web applications. From an ATT&CK framework perspective, this vulnerability maps to T1213.002 (Data from Information Repositories) and T1499.004 (Resource Hijacking) as attackers can manipulate data repositories and potentially consume system resources through excessive vote submissions. Organizations should implement immediate mitigations including plugin updates to versions that address this race condition, deployment of rate limiting measures, and monitoring for suspicious voting patterns. Additionally, administrators should consider implementing CAPTCHA mechanisms and IP-based restrictions to reduce the likelihood of automated exploitation attempts.