TS Poll – Survey, Versus Poll, Image Poll, Video Poll (WordPress plugin slug: poll-wp) has a Medium-severity missing authorization issue tracked as CVE-2025-68588. According to the public advisory, versions up to and including 2.5.5 lack a required capability check on a function, enabling authenticated attackers (subscriber-level and above) to perform an unauthorized action. The published score is CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

Attack Vectors

This vulnerability can be reached over the network and does not require user interaction, which means it may be exploitable through normal website access paths once an attacker is logged in. The advisory notes that an attacker needs only subscriber-level permissions or higher, making risk higher for organizations that allow public account registration (e.g., for newsletters, communities, gated content, partner portals, or customer login areas).

Even if you do not offer open registration, the same risk can apply if an existing low-privilege account is compromised through password reuse, phishing, or credential stuffing. In business terms: the “weakest” account type can become the entry point.

Security Weakness

The root cause is a missing authorization (capability) check on a plugin function in TS Poll versions <= 2.5.5. In WordPress, capability checks are a primary control that prevents lower-privileged users from triggering administrative or sensitive actions.

Because the advisory describes the issue as allowing an unauthorized action (without detailing the specific action), the practical outcome depends on how your site uses TS Poll and which workflows are connected to it. Regardless, missing authorization controls are a governance concern because they break the intended separation between “basic user” and “site operator” activities.

Remediation: Update TS Poll to version 2.6.0 or a newer patched release, as recommended by the source advisory.

Technical or Business Impacts

While the published CVSS indicates low integrity impact and no direct confidentiality or availability impact, missing authorization issues can still create meaningful business exposure. If an unauthorized action affects poll content, settings, or site workflows, it can lead to inaccurate reporting, skewed campaign insights, or operational confusion—especially when polls are used for customer feedback, product preference testing, HR/internal sentiment checks, or compliance-related attestations.

For marketing directors and executives, the biggest risk is often decision-quality and brand trust: tampered survey outcomes can misdirect spend, distort A/B learnings, and undermine stakeholder confidence in customer research. For compliance teams, unauthorized actions (even “minor” ones) can complicate audit trails and raise questions about access controls and change management.

Similar Attacks

Missing authorization and authorization-bypass issues are a common pattern across platforms and routinely lead to real-world incidents. Examples include:

CVE-2023-22518 (Atlassian Confluence) – improper authorization / authorization bypass
CVE-2022-40684 (Fortinet FortiOS/FortiProxy/FortiSwitchManager) – authentication/authorization bypass

These examples show why organizations should treat authorization gaps as more than “just a plugin bug”: they are frequently used to move from a small foothold to higher-impact outcomes when combined with other weaknesses (compromised credentials, misconfigurations, or additional vulnerable components).