CVE-2026-27044
Remote Code Inclusion in Total Poll Lite
Publication date: 2026-03-25
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| totalsuite | total_poll_lite | to 4.12.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
CVE-2026-27044 is a Remote Code Execution vulnerability that allows attackers with certain privileges to execute arbitrary commands and potentially gain full control over affected websites. Such unauthorized access and control can lead to data breaches or unauthorized data manipulation.
Because of the high severity and potential for exploitation, this vulnerability could impact compliance with data protection regulations such as GDPR and HIPAA, which require organizations to protect personal and sensitive data from unauthorized access and breaches.
Failure to mitigate or patch this vulnerability could result in violations of these regulations due to compromised data confidentiality, integrity, and availability.
Can you explain this vulnerability to me?
CVE-2026-27044 is a Remote Code Execution (RCE) vulnerability in the WordPress Total Poll Lite Plugin versions up to and including 4.12.0.
This vulnerability allows an attacker with at least Contributor or Developer privileges to execute arbitrary commands on the affected website.
It is classified as a medium priority by Patchstack but has a high CVSS severity score of 9.9, indicating it is highly dangerous and likely to be exploited in mass campaigns.
The flaw falls under the OWASP Top 10 category A3: Injection and involves improper control of code generation, specifically Remote Code Inclusion.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can gain backdoor access and full control over the affected website.
This means the attacker can execute arbitrary commands, potentially compromising website data, functionality, and security.
Such control can lead to defacement, data theft, unauthorized access to sensitive information, or using the site as a launchpad for further attacks.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
CVE-2026-27044 is a Remote Code Execution vulnerability in the WordPress Total Poll Lite Plugin up to version 4.12.0. Detection typically involves monitoring for exploitation attempts targeting this plugin, especially requests that attempt to inject or execute arbitrary code.
Patchstack has issued a mitigation rule (PSID 2a899c700098) that can block exploitation attempts, which can be used as part of detection and prevention.
While no specific commands are provided in the available resources, common detection methods include:
- Monitoring web server logs for suspicious requests targeting the Total Poll Lite plugin endpoints.
- Using web application firewall (WAF) rules or mitigation rules provided by Patchstack to detect and block exploitation attempts.
- Scanning the WordPress installation for the plugin version to confirm if it is vulnerable (version <= 4.12.0).
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps for CVE-2026-27044 include applying the mitigation rule provided by Patchstack to block exploitation attempts until an official patch is released.
Users are strongly advised to update the Total Poll Lite plugin to a patched version once it becomes available.
If updating is not immediately possible, seek assistance from your hosting provider or web developer to implement the mitigation rule or other protective measures.
Additionally, restrict plugin access to trusted users only, as the vulnerability requires at least Contributor or Developer privileges to be exploited.