CVE Intelligence
Analysis AI-assisted

CVE-2026-27044: TotalSuite Total Poll Lite Code Injection Vulnerability

CVE-2026-27044 is a code injection weakness (CWE-94) in the Total Poll Lite plugin (totalpoll-lite) by TotalSuite, which the CNA describes as allowing remote code inclusion. The record lists versions through 4.12.0 as affected and assigns a CVSS 3.1 base score of 9.9 from Patchstack. No fixed version and no confirmed exploitation appear in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-27044 is a code injection weakness (CWE-94) in the Total Poll Lite plugin (totalpoll-lite) from TotalSuite. The CNA description states that it allows remote code inclusion and lists versions through 4.12.0 as affected.

Impact

  • The record assigns a CVSS 3.1 base score of 9.9 (critical), provided by Patchstack.
  • The vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates network reachability, low complexity, low privileges required, no user interaction, scope change, and high impact to confidentiality, integrity and availability.
  • Remote code inclusion can allow an attacker to influence code executed by the affected application, so the consequences may be severe.

Affected products and versions

  • Product: TotalSuite Total Poll Lite (totalpoll-lite).
  • Affected range as stated in the record: from n/a through and including 4.12.0. The lower bound is not specified.
  • The record contains no structured affected or fixed version entries.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS value in the record (probability 0.00518, percentile 0.42451) is a statistical likelihood estimate and is not evidence of exploitation.

Remediation and mitigation

  • Inventory all installations of Total Poll Lite and record their versions.
  • Check the Patchstack advisory for current guidance, since the record does not name a fixed version.
  • Where practical, deactivate or remove the plugin until a vendor-confirmed fixed release is verified.
  • Restrict administrative and write access to the web application and keep the CMS core and other plugins up to date.

Detection guidance

  • Review web server and application logs for unexpected requests targeting the plugin.
  • Watch for unexpected files or modifications in plugin and upload directories.
  • Monitor for unusual outbound connections from web servers, which may indicate loading of external content.

Limitations of the available information

  • The record does not give the lower bound of the affected range, a fixed version, or technical details of the vulnerable component.
  • The CNA-provided CVSS is the only score listed; no NVD score is shown in the record.
  • The EPSS date in the record is later than the publication date and should be verified against the FIRST source.

Frequently asked questions

What is CVE-2026-27044?

It is a code injection vulnerability (CWE-94) in the Total Poll Lite plugin by TotalSuite that the CNA describes as allowing remote code inclusion.

Which versions are affected?

The record states versions from n/a through and including 4.12.0 are affected. The lower bound is not specified and no fixed version is listed.

Is this vulnerability known to be exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Inventory installations, consult the Patchstack advisory for updated guidance, consider deactivating the plugin until a verified fix is available, and monitor logs for unexpected activity.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.