SALESmanago & Leadoo CVE-2026-10835

Exploitation requires an authenticated WordPress account with only minimal privileges (subscriber-level), and the target must run the SALESmanago & Leadoo plugin at a version before 3.11.3. The attacker must reach the specific vulnerable AJAX action via admin-ajax.php and supply a malicious value in the unsanitised parameter; no administrator rights, no user interaction, and no non-default plugin configuration are needed (PR:L/UI:N). The principal limiting factor is the authentication requirement - the site must allow the attacker to obtain a low-privilege account, which is easiest where open user registration is enabled, making that the practical gating condition for real-world exploitation.

Signals are mixed and point to a moderate, not critical, real-world priority. CVSS 7.7 is driven by AV:N/AC:L/PR:L/UI:N with a changed scope and C:H - network-reachable, low-complexity, and exploitable by any authenticated user down to subscriber, which on sites permitting open registration effectively lowers the bar. Counterbalancing this, EPSS is only 0.16% (6th percentile) and SSVC rates exploitation as 'poc' with Automatable:no and Technical Impact:partial, indicating no observed mass exploitation and that attacks are not trivially scriptable at scale. Public exploit code exists (a distinct signal from active exploitation), and there is no CISA KEV listing. Impact is also bounded: the official vector sets I:N/A:N, characterising this as data disclosure rather than full database takeover. Net: prioritise for sites that allow self-registration, but based on current data this is not an emergency, actively-exploited scenario.

An attacker registers (or reuses) a low-privilege subscriber account on a WordPress site running the vulnerable plugin, then sends a crafted authenticated AJAX request with a malicious value in the unsanitised parameter. Because the action enforces no authorisation, the injected SQL executes against the WordPress database, letting the attacker extract sensitive data such as user records and password hashes. Public proof-of-concept exploit code from WPScan lowers the effort required.