WordPress · Poll Maker · CVE-2026-8995
**Name of the Vulnerable Software and Affected Versions**
Poll Maker – Versus Polls, Anonymous Polls, Image Polls versions prior to 6.3.8
**Description**
Insufficient access controls in the 'ays poll get user information' AJAX action allow authenticated attackers with subscriber-level access or higher to retrieve sensitive account data. The system serializes and returns the complete `WP User` object without nonce verification or capability checks beyond verifying if the user is logged in. Exposed data includes the `user pass` (bcrypt password hash), `user email`, `user login`, `user registered`, roles, and all capabilities. This information, particularly the password hash, can be used for offline password-cracking attacks.
**Recommendations**
Update to a version later than 6.3.7.
As a temporary workaround, restrict access to the 'ays poll get user information' AJAX action to minimize the risk of exploitation.