CVE-2020-11673

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., delete, clone, or view a hidden poll. This is due to the usage of the callback wp_ajax_nopriv function in Includes/Total-Soft-Poll-Ajax.php for sensitive operations.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Apr 13, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-116748.8Cerner medico 26.00 allows variable reuse, possibly causing data corruption.CVE-2020-116758.8Cerner medico 26.00 has a Local Buffer Overflow (issue 1 of 3).CVE-2020-116768.8Cerner medico 26.00 has a Local Buffer Overflow (issue 2 of 3).CVE-2020-116778.8Cerner medico 26.00 has a Local Buffer Overflow (issue 3 of 3).CVE-2020-116798.8Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/User CVE-2020-116806.5Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a re CVE-2020-116818.1Castel NextGen DVR v1.0.0 stores and displays credentials for the associated SMTP server in cleartext. Low privileged users can exploit this CVE-2020-116826.5Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and CVE-2020-116836.8A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC valu CVE-2020-116849.1AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged CVE-2020-116857.5In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS.CVE-2020-116862.7In JetBrains TeamCity before 2019.1.4, a project administrator was able to retrieve some TeamCity server settings.