What is the CVSS score of CVE-2026-10835?

CVE-2026-10835 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of SALESmanago & Leadoo are affected by CVE-2026-10835?

The SALESmanago & Leadoo WordPress plugin (before version 3.11.3) contains a vulnerability that allows subscriber-level WordPress users to extract sensitive data from the organization's database,…. A patch is available.

Is there a public PoC exploit available for CVE-2026-10835?

Yes, a public proof-of-concept exploit is available for CVE-2026-10835. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-10835?

Within 24 hours: Identify all WordPress instances using SALESmanago & Leadoo plugin and document current versions. Within 7 days: Apply vendor-released patch to version 3.11.3 or later across all affected WordPress installations. Within 30 days: Audit database access logs for signs of exploitation and confirm all instances are running patched versions.

SALESmanago & Leadoo CVE-2026-10835

EUVD-2026-39625 HIGH

2026-06-26 WPScan

GHSA-mprc-69fc-33c7

WordPress SQLi Salesmanago Leadoo Unknown

7.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable AJAX action exploitable by any authenticated subscriber gives AV:N/AC:L/PR:L/UI:N; SQLi reads data outside the plugin's context (S:C, C:H) but the description indicates disclosure only, so I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 18:31 vuln.today

CVSS changed

Jun 26, 2026 - 16:22 NVD

7.7 (HIGH)

Patch available

Jun 26, 2026 - 08:01 EUVD

CVE Published

Jun 26, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 26, 2026 - 06:00 cve.org

HIGH 7.7

DescriptionCVE.org

The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.

Articles & Coverage 1

News 11 New WordPress Vulnerabilities - 1 Critical, 10 High, 2 With POC Jun 27, 2026

AnalysisAI

SQL injection in the SALESmanago & Leadoo WordPress plugin before 3.11.3 allows low-privileged authenticated users to inject arbitrary SQL through an unsanitised parameter passed to a vulnerable AJAX action. Because the action enforces no authorisation check, even subscriber-level accounts can reach it, and the CVSS scope-changed, high-confidentiality rating (7.7) reflects the ability to read data across the WordPress database. Publicly available exploit code exists (WPScan), though EPSS is low (0.16%) and SSVC classifies exploitation as proof-of-concept only, not active.

Technical ContextAI

The affected component is a WordPress plugin that integrates the SALESmanago and Leadoo marketing-automation platforms with WordPress sites, exposing functionality through the standard admin-ajax.php AJAX action mechanism. The root cause is a classic SQL injection (CWE-89, though the feed lists CWE as N/A): a request parameter is concatenated into a SQL statement without proper sanitisation or escaping. This is compounded by a broken-access-control flaw (CWE-862, missing authorization) on the same AJAX action, so the privilege boundary that should restrict the handler to higher-privileged roles is absent. The CPE (cpe:2.3:a:unknown:salesmanago_&_leadoo:*) covers all plugin versions prior to the 3.11.3 fix.

RemediationAI

Vendor-released patch: upgrade the SALESmanago & Leadoo plugin to version 3.11.3 or later, per the WPScan advisory (https://wpscan.com/vulnerability/3c7b37ab-b069-4257-82b2-5b4c54f7e503/). If immediate patching is not possible, reduce exposure by restricting who can authenticate: disable open self-registration (Settings → General → 'Anyone can register') so attackers cannot freely create the subscriber accounts the flaw requires - note this blocks legitimate self-service signup. As an additional compensating control, add a WAF rule to block or filter requests to the plugin's vulnerable admin-ajax.php action from low-privileged roles, accepting that this may break the plugin's legitimate AJAX functionality. While remediating, audit existing low-privilege accounts and database query logs for anomalous activity.