CVE-2016-20067

WordPress CP Polls 1.0.8 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions on behalf of authenticated users. Attackers can craft malicious HTML pages that execute unwanted poll operations when administrators visit the page while logged in.

CVSS v4.0

5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.11% chance of exploitation in the next 30 days, 2th percentile

Published

2026-06-15

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/39513

References

• CVE Record
• NVD entry

Related

• CVE-2016-20066
• CVE-2016-20068
• CVE-2016-20065
• CVE-2016-20069
• CVE-2016-20064
• CVE-2016-20070