Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U L N N 5.3 .0021 11.5 —
AFFECTED Product Versions Fixed YOP Poll 7.0.0 – —
TIMELINE Jul 6 Reserved by WPScan Aug 1 Published (CNA: WPScan) Aug 4 EXPLOIT PUBLISHED — CVE-2026-14840 (Unknown YOP Poll). Public exploit reference added.
The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.
| Date | Event | Detail |
|---|---|---|
| July 6, 2026 | Reserved | Reserved by WPScan |
| August 1, 2026 | Published | Published (CNA: WPScan) |
| August 4, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-14840 (Unknown YOP Poll). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Unknown | YOP Poll | — | 7.0.0 | — |
Authoritative record: CVE-2026-14840 at cve.org
Weaknesses: CWE-290
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-14840 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.