CVE-2026-39651

MediumCVSS 6.5

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

8th percentile - higher than 8% of all known CVEs

Summary

The Total Poll Lite plugin for WordPress up to version 4.12.0 has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Risk Assessment

The organization risks unauthorized creation, modification, or deletion of polls, potentially leading to result manipulation and data integrity issues.

Recommendation

Update the Total Poll Lite plugin to the latest version. Review WordPress permission settings.

Original NVD description (English source)

Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total Poll Lite: from n/a through <= 4.12.0.