CVE-2026-85682 is an origin validation error (CWE-346) in the YOP Poll WordPress plugin versions up to and including 7.0.10. The plugin transmits a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin, enabling an attacker to intercept the nonce. This nonce is scoped to a logged-in Administrator, and if stolen, can be used by an unauthenticated attacker to change the Administrator's email address and password, resulting in full account takeover. Exploitation requires user interaction where the Administrator opens an attacker-controlled page.

An unauthenticated attacker can steal a REST nonce scoped to an Administrator, enabling them to change the Administrator's email and password. This leads to full compromise of the Administrator account, allowing complete control over the WordPress site. The vulnerability requires the Administrator to open a malicious page, so social engineering or phishing is a prerequisite for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid opening untrusted or attacker-controlled web pages to prevent exploitation. Monitor for updates from the plugin vendor regarding patches or official fixes.