What is the CVSS score of CVE-2026-1255?

CVE-2026-1255 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-1255?

Within 24 hours, inventory all WordPress sites running the YS LeadGen plugin, identify any instances at versions up to and including 2.1.4, and disable or remove the plugin until a safe alternative is in place; if removal is not immediately possible, block requests to the plugin's vulnerable AJAX action at the web server or WAF and restrict access to admin-ajax.php where feasible. Within 7 days, confirm whether the vendor has released a patched version beyond 2.1.4, and if no vendor-released patch is identified, implement targeted virtual patching or a WAF rule to deny the vulnerable AJAX action, review web logs for anomalous POST requests to admin-ajax.php associated with YS LeadGen, and assess the volume and sensitivity of lead data stored. Within 30 days, if no vendor patch is available, replace YS LeadGen with a maintained lead-capture plugin or apply a vetted code fix, rotate any exposed secrets, and follow applicable privacy and breach-notification obligations for affected individuals whose names, email addresses, and message content may have been disclosed.

YS LeadGen CVE-2026-1255

EUVD-2026-83564 HIGH

Information Exposure (CWE-200)

2026-09-19 Wordfence

GHSA-48p5-g4jp-2qq5

WordPress Information Disclosure Wordpress Plugin Ys Leadgen Popup Builder Popup Maker Form Builder For Wordpress Lead Generation Email Marketing Sales Conversions Opt Ins Subscribers

7.5

CVSS 3.1 · Vendor: Wordfence

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify site running YS LeadGen ≤2.1.4
Exploit

Send unauth POST to admin-ajax.php action=ysleadgen_get_captured_data
Execution

Handler returns captured submissions without auth
Impact

Harvest names/emails/messages (PII exfiltration)

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of the YS LeadGen WordPress plugin (versions <=2.1.4). The only functional prerequisite is that the site has the plugin active and has captured at least some form submission data to exfiltrate; the vulnerable 'ysleadgen_get_captured_data' AJAX action is exposed to unauthenticated users by design of the flaw (registered on the wp_ajax_nopriv hook), so no authentication, user interaction, or non-default setting is required. The main practical limit on impact is simply how much PII a given installation has collected.
Impact	This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5) is internally consistent with the description: an AJAX action registered for unauthenticated users (wp_ajax_nopriv), reachable over the network with no complexity barrier, no privileges, and no user interaction. The C:H/I:N/A:N shape correctly reflects a pure confidentiality/data-exposure flaw. Unlike many WordPress plugin CVEs that mislabel authenticated authorization gaps as 'authentication bypass', this one is truly unauthenticated (PR:N) and the CWE-200 / Information Disclosure classification is accurate. Weighing the signals: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no confirmed evidence of active or automated exploitation. However, the low technical barrier (a single crafted admin-ajax.php request) and the sensitive nature of the exposed data (PII harvested from lead-gen forms) make opportunistic mass-scanning plausible. Net: prioritize patching promptly; the absence of KEV/EPSS reflects lack of tracking data, not low exploitability.
Exploit ScenarioDerived	An unauthenticated attacker sends a crafted POST/GET to /wp-admin/admin-ajax.php invoking action=ysleadgen_get_captured_data against any site running YS LeadGen <=2.1.4, and the handler returns all captured form submissions - names, email addresses, and message content - with no login or nonce required. Because the endpoint is network-reachable and default-configured, this is trivially scriptable at scale across many sites. No public exploit code was identified at time of analysis, but the technique is straightforward to reproduce from the description.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 19, 2026

Unauthenticated information disclosure in the YS LeadGen plugin for WordPress (all versions up to and including 2.1.4) lets any remote attacker dump the entire store of captured lead-form submissions by simply invoking the plugin's AJAX action, exposing names, email addresses, and message content of every visitor who filled out a form. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is remote, unauthenticated, and requires no user interaction, and our independent assessment rates it a genuine high-priority issue rather than a high-score-but-low-real-risk case, because the exposed data is directly monetizable PII and the only practical limiter is how much data a given site has collected - not any defensive barrier. No public exploit code and no active exploitation have been identified at time of analysis, but the barrier to abuse is trivially low for anyone able to reach the site.

RemediationAI

The referenced plugin changeset at https://plugins.trac.wordpress.org/changeset/3577391 appears to contain the upstream fix (Upstream fix available (PR/commit); released patched version not independently confirmed), so administrators should update YS LeadGen to the newest available release above 2.1.4 as soon as it is published and verify the installed version in the WordPress Plugins screen rather than assuming an auto-update has landed. If an immediate update is not possible, the most effective compensating control is to deactivate the plugin entirely - this fully closes the AJAX endpoint but, as a side effect, removes all live forms and stops new lead capture; a narrower option is to block the abuse path with a WAF or server rule that denies requests to /wp-admin/admin-ajax.php where the action parameter equals ysleadgen_get_captured_data (or, more bluntly, blocks anonymous POSTs to admin-ajax.php carrying that action string), accepting the trade-off that legitimate front-end AJAX features relying on the same endpoint may need scoping, and that path-based rules can be bypassed by query-string obfuscation. Because the endpoint returns data rather than modifying it, blocking is safe to apply aggressively. Treat any data already retrieved as compromised: lead records should be considered breached, affected individuals notified per applicable privacy regulation, and stored submissions purged or migrated. Administrators should also assume the endpoint has been reachable since an early plugin version and review web server logs for GET/POST requests containing the string yseleadgen_get_captured_data.

Affected VersionsENISA

YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers 0 ≤2.1.4

Affected Packages

euvd ys_leadgen_popup_builder_popup_maker_form_builder_for_wordpress_lead_generation_email_marketing_sales_conversions_opt_ins_subscribers no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

YS LeadGen is a WordPress lead-generation, popup-builder, and form-builder plugin distributed through the WordPress.org repository by YS Innovations; the affected package is captured in CPE as ysinnovations:ys_leadgen_-_popup_builder,_popup_maker_&_form_builder_for_wordpress_|_lead_generation,_email_marketing,_sales,_conversions,_opt-ins_&_subscribers. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the plugin's AJAX handler function, exposed in the plugin source at app/Controllers/Ajax.php (visible in the WordPress.org Trac browser at plugin tag 1.1.1, line 65 and still present through 2.1.4), is registered against WordPress's wp_ajax_nopriv_ hook namespace via the 'ysleadgen_get_captured_data' action. The nopriv registration is the critical defect: WordPress uses wp_ajax_{action} for logged-in users and wp_ajax_nopriv_{action} for anonymous visitors, so any code hooked to nopriv is reachable without authentication by definition. Because the handler lacks a capability check or nonce validation before reading and returning captured form records, a single unauthenticated HTTP request to the site's admin-ajax.php endpoint with the action parameter set to ysleadgen_get_captured_data returns the plugin's stored submission table - the same records the plugin uses to build its subscriber/lead dashboard. The flaw therefore sits in the plugin's access-control layer rather than in its data-storage or parsing logic, and it has been present across the plugin's version history as demonstrated by the Trac link pointing to the file at tag 1.1.1.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Wordfence) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Unauthenticated (PR:N) network AJAX action with no interaction returns all captured PII, giving high confidentiality impact and no integrity/availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.

Executive ViewAI

Why It Matters

Organizations running the YS LeadGen plugin for WordPress at versions up to and including 2.1.4 face unauthorized access to their entire store of captured lead-form submissions, including names, email addresses, and message content. Because this data is directly monetizable personal information and the flaw is remotely exploitable by an unauthenticated attacker, leadership should treat it as a privacy, compliance, and reputational risk rather than a routine plugin issue. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, so exposure remains until interim controls or plugin replacement are implemented.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include disabling or removing YS LeadGen versions up to and including 2.1.4, blocking the vulnerable AJAX action via WAF or web server rules, restricting admin-ajax.php access to trusted IPs where operationally possible, monitoring logs for unauthorized data retrieval, and migrating to a maintained lead-capture plugin.

Threat Intelligence Overview

EPSS Score

0.3%

Top 78% exploitable

Prevalence

Medium

popular WordPress lead-generation/popup/form-builder plugin, common but not ubiquitous

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.