CVE-2026-8995 is a sensitive information exposure vulnerability in the Poll Maker by AYS WordPress plugin (up to version 6.3.7). The issue arises from the 'ays_poll_get_user_information' AJAX action, which returns the full WP_User object—including the bcrypt password hash, user email, login, registration date, roles, and capabilities—without proper nonce verification or capability checks beyond verifying the user is logged in. This allows authenticated users with subscriber-level privileges or higher to access sensitive account data not normally exposed by WordPress interfaces, increasing the risk of offline password cracking attacks.

Authenticated users with subscriber-level access or higher can access sensitive user information including password hashes, email addresses, and user roles. This exposure can lead to offline password cracking attempts, potentially compromising user accounts. The vulnerability does not allow unauthenticated access and does not impact integrity or availability, resulting in a medium severity rating (CVSS 4.3). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict plugin usage to trusted users only and consider disabling or limiting access to the vulnerable AJAX action if possible. Monitor vendor channels for updates and apply official patches promptly once released.