CVE-2026-27044: 
WordPress vulnerability analysis and mitigation

CVE-2026-27044 is a critical code injection vulnerability (CWE-94) in the TotalSuite Total Poll Lite WordPress plugin that allows authenticated attackers to perform Remote Code Inclusion (RCI), enabling arbitrary code execution on the affected server. It affects all versions of Total Poll Lite through 4.12.0, with no official patch currently available. The vulnerability was reported on December 15, 2025, and publicly disclosed on March 16–25, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) (Patchstack, Feedly).

The vulnerability stems from improper control of code generation (CWE-94) within the Total Poll Lite plugin, allowing user-controlled input to be passed into a code inclusion mechanism without adequate sanitization or validation. This enables an authenticated attacker (with at minimum Contributor-level privileges) to include and execute remote code on the server — a technique classified as Remote Code Inclusion (RCI). The attack vector is network-based, requires low privileges, no user interaction, and has a changed scope, meaning the impact extends beyond the vulnerable component itself. The vulnerability was discovered by researcher 'hhhhai' and reported to Patchstack (Patchstack).

Successful exploitation allows an authenticated attacker to execute arbitrary code on the underlying server hosting the WordPress installation, resulting in complete compromise of confidentiality, integrity, and availability. Consequences include full takeover of the WordPress site, data theft, malware or backdoor injection, site defacement, and potential lateral movement within the hosting network or infrastructure (Feedly, Patchstack).

As of the time of disclosure, no public proof-of-concept exploit code has been published and no confirmed in-the-wild exploitation has been reported. The EPSS score is approximately 0.047%, indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability requires at least Contributor-level WordPress authentication, which somewhat limits the attack surface, though Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack, Feedly). The vulnerability is not currently listed in the CISA KEV catalog.

1. Reconnaissance: Identify WordPress sites running the Total Poll Lite plugin (version ≤ 4.12.0) using tools such as WPScan, Shodan, or by inspecting publicly accessible plugin metadata (e.g., /wp-content/plugins/totalpoll-lite/readme.txt).
2. Obtain low-privilege access: Register or obtain credentials for a Contributor-level (or higher) WordPress account on the target site, which is the minimum privilege required to trigger the vulnerability.
3. Identify the vulnerable code path: Locate the plugin functionality that processes user-controlled input and passes it to a file inclusion or code generation function without proper sanitization.
4. Craft malicious payload: Prepare a remote code inclusion payload pointing to an attacker-controlled server hosting malicious PHP code (e.g., a web shell or reverse shell script).
5. Submit payload: Submit the crafted input through the plugin's vulnerable parameter or form field, triggering the server to fetch and execute the remote code.
6. Achieve code execution: The server executes the attacker's code in the context of the web server process, enabling arbitrary command execution, backdoor installation, data exfiltration, or further lateral movement (Patchstack).

• Network: Outbound HTTP/HTTPS requests from the web server to unknown or suspicious external IP addresses or domains (indicative of remote file inclusion fetching attacker-hosted payloads); unusual DNS lookups originating from the WordPress server process.
• File System: Unexpected PHP files or web shells appearing in the WordPress installation directory, particularly within /wp-content/plugins/totalpoll-lite/; newly created or modified files with obfuscated PHP code.
• Logs: WordPress and web server access logs showing unusual POST or GET requests to Total Poll Lite plugin endpoints with suspicious parameter values; PHP error logs referencing remote URL inclusion or include/require calls to external URLs.
• Process: Unusual child processes spawned by the web server (e.g., bash, curl, wget, python) that are not typical for normal WordPress operation; unexpected cron jobs or scheduled tasks created under the web server user account (Feedly, Patchstack).

No official patch from TotalSuite is currently available for Total Poll Lite. The recommended immediate action is to disable or completely remove the Total Poll Lite plugin from all affected WordPress installations running version 4.12.0 or earlier. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Additionally, administrators should implement Web Application Firewall (WAF) rules to block code injection attempts, review server and access logs for suspicious activity, restrict WordPress user registrations to limit attacker access to Contributor-level accounts, and isolate any systems suspected of compromise (Patchstack, Feedly).

The vulnerability was covered by The Hacker Wire, which published an article highlighting the critical nature of the RCI flaw in Total Poll Lite (The Hacker Wire). Wordfence included it in their weekly WordPress vulnerability report for the period of March 16–22, 2026 (Wordfence). The Tanzania Computer Emergency Response Team (TZ-CERT) also issued a security advisory highlighting the risk to WordPress site operators (TZ-CERT). Social media discussion was limited, with brief mentions on Mastodon from The Hacker Wire account.