The LiquidPoll – Polls, Surveys, NPS and Feedback Reviews WordPress plugin versions up to 3.3.76 contain a sensitive information exposure vulnerability (CWE-200) exploitable through the poller_list shortcode. Authenticated attackers with contributor-level privileges or above can extract private poll information that should not be accessible to them. The CVSS 3.1 base score is 4.3 (medium), reflecting the network attack vector, low complexity, and limited confidentiality impact. No known exploits in the wild or official patches have been documented in the provided data.

An attacker with contributor-level or higher access to a WordPress site using the vulnerable LiquidPoll plugin can access sensitive poll data that may be intended to remain private. This exposure affects confidentiality but does not impact integrity or availability. The vulnerability does not allow unauthenticated access, limiting exploitation to users with some level of site permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the LiquidPoll plugin if sensitive poll data confidentiality is critical.