CVE-2016-20067

Vulnerability

WordPress CP Polls plugin version 1.0.8 contains a cross-site request forgery (CSRF) vulnerability. The plugin does not implement anti-CSRF tokens for administrative actions, specifically when updating poll settings via the options-general.php?page=CP_Polls&cal=1 endpoint. This allows an attacker to craft a malicious HTML page that, when visited by a logged-in administrator, will execute unwanted poll operations, such as modifying poll options or injecting persistent cross-site scripting (XSS) payloads. The vulnerability affects all installations using CP Polls 1.0.8 [1][2].

Exploitation

An attacker must first identify a valid poll ID (visible in the page source as a hidden CP_Polls_id field) [1]. The attacker then crafts a malicious HTML page containing a cross-site request forgery payload that targets the vulnerable endpoint. The attacker lures a logged-in WordPress administrator to visit this crafted page via social engineering (e.g., phishing email, malicious link). Once the administrator’s browser loads the page, the forged request is automatically sent with the administrator’s session cookies, leading to execution of the poll update without the victim’s consent. Because the request is a POST with CSRF-able parameters, no additional authentication or interaction is required beyond the initial visit [1][2].

Impact

A successful exploitation allows the attacker to arbitrarily modify poll settings (e.g., questions, answers, display options) and, due to the concurrent persistent XSS vulnerability from unsanitized option values, inject malicious scripts into the poll pages [1]. This can lead to data tampering, defacement, or further XSS attacks against other visitors who view the affected poll. The attacker acts with the privileges of the compromised administrator, enabling full manipulation of the CP Polls plugin functionality. The CVSS v3.1 score of 4.3 reflects the medium severity, requiring user interaction and authenticated access [2].

Mitigation

As of the published references, no official patch has been released for CP Polls 1.0.8 to address this CSRF vulnerability [1][2]. Users are advised to upgrade to later versions of the CP Polls plugin if available, or disable the plugin until a patched version is released. Administrators should be cautious when clicking links from untrusted sources and consider using plugins that enforce a nonce-based CSRF protection mechanism on admin pages. The plugin is no longer actively maintained, so migrating to an alternative polling solution is recommended.