{"id":"CVE-2022-1581","aliases":["EUVD-2022-24872","GHSA-27qm-jwxp-8whw"],"status":"published","title":"WP-Polls \u003c 2.76.0 - IP Validation Bypass","description":"The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00698,"percentile":0.53433,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2022-11-21T00:00:00Z","modified":"2026-06-17T04:22:42Z","products":[{"vendor":"gamerz","product":"wp-polls"},{"vendor":"unknown","product":"wp-polls"},{"vendor":"wp-polls_project","product":"wp-polls"}],"references":[{"url":"https://wpscan.com/vulnerability/c1896ab9-9585-40e2-abbf-ef5153b3c6b2","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.hightechdad.com/2009/12/21/warning-wp-polls-wordpress-poll-plugin-can-be-exploited/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1581"},{"url":"https://www.hightechdad.com/2009/12/21/warning-wp-polls-wordpress-poll-plugin-can-be-exploited"},{"url":"https://github.com/advisories/GHSA-27qm-jwxp-8whw"}],"sources":{"cve":[{"id":"CVE-2022-1581","title":"WP-Polls \u003c 2.76.0 - IP Validation Bypass","description":"The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.","status":"published","published":"2022-11-21T00:00:00Z","modified":"2025-04-30T15:00:03.896Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:38.263045Z"}],"euvd":[{"id":"EUVD-2022-24872","description":"The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.","status":"published","published":"2022-11-21T00:00:00Z","modified":"2025-04-30T15:00:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:51:59.458406Z"}],"ghsa":[{"id":"GHSA-27qm-jwxp-8whw","title":"The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP...","description":"The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.","status":"published","published":"2022-11-21T12:30:16Z","modified":"2025-04-30T15:31:47Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:02:04.725122Z"}],"nvd":[{"id":"CVE-2022-1581","description":"The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.","status":"published","published":"2022-11-21T11:15:20.037Z","modified":"2026-06-17T04:22:42.707Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:32.395456Z"}]}}