CVE-2026-39651: 
WordPress vulnerability analysis and mitigation

CVE-2026-39651 is a Missing Authorization vulnerability in the TotalSuite Total Poll Lite WordPress plugin (slug: totalpoll-lite) that allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. It affects all versions of Total Poll Lite through 4.12.0. The vulnerability was disclosed on April 8, 2026, by Patchstack, and a patch has been made available. The CVSS v3.1 base score is 6.3 (Medium) per CISA-ADP, and 6.5 (Medium) per Patchstack (GitHub Advisory, Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks when an authenticated user attempts to access certain resources or perform specific actions. An attacker with a low-privileged WordPress account (e.g., a subscriber) can send crafted network requests to plugin endpoints that lack proper capability checks, thereby accessing or manipulating functionality reserved for higher-privileged roles. No public proof-of-concept or detailed technical write-up has been published at this time (GitHub Advisory, Patchstack).

Successful exploitation could allow a low-privileged authenticated attacker to access sensitive poll data, modify poll configurations, or perform unauthorized administrative actions within the Total Poll Lite plugin. The impact spans confidentiality, integrity, and availability at a low level each, per CISA-ADP scoring, though Patchstack rates the confidentiality impact as high. The scope is limited to the affected WordPress installation and does not inherently enable lateral movement beyond the plugin's functionality (GitHub Advisory, Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.017–0.035%, placing it in a low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privileged account on the target WordPress site, limiting opportunistic mass exploitation (GitHub Advisory).

Update the Total Poll Lite plugin to a version greater than 4.12.0, which includes properly implemented authorization controls. WordPress site administrators should apply the update via the WordPress plugin dashboard or by downloading the patched version from the official repository. Until patching is possible, consider restricting access to the WordPress site to trusted users only or temporarily deactivating the plugin. Monitor the GitHub Advisory GHSA-4483-ppjr-hhm4 for updated patching guidance (GitHub Advisory, Patchstack).