What is the CVSS score of CVE-2026-1890?

CVE-2026-1890 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Leadconnector are affected by CVE-2026-1890?

Organizations using LeadConnector WordPress should be aware of moderate risk from CVE-2026-1890 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2026-1890?

Yes, a public proof-of-concept exploit is available for CVE-2026-1890. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-1890?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Leadconnector CVE-2026-1890

EUVD-2026-16124 MEDIUM

2026-03-26 WPScan

GHSA-795h-9vq2-6x3x

WordPress Information Disclosure Leadconnector Unknown

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.0.22

PoC Detected

Mar 26, 2026 - 15:13 vuln.today

Public exploit code

EUVD ID Assigned

Mar 26, 2026 - 06:30 euvd

EUVD-2026-16124

Analysis Generated

Mar 26, 2026 - 06:30 vuln.today

CVE Published

Mar 26, 2026 - 06:00 nvd

MEDIUM 5.3

DescriptionCVE.org

The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data

AnalysisAI

The LeadConnector WordPress plugin before version 3.0.22 contains an authorization bypass vulnerability in a REST API endpoint, allowing unauthenticated attackers to overwrite existing data without authentication. This vulnerability affects an unknown vendor's LeadConnector product and has a publicly available proof-of-concept exploit, making it actively exploitable. The vulnerability enables unauthorized data manipulation, which could compromise business data integrity and customer information stored within the plugin.

Technical ContextAI

The vulnerability resides in the LeadConnector WordPress plugin's REST API implementation. WordPress REST routes, when improperly configured, can be exposed to unauthenticated callers if proper permission callbacks are not registered or enforced. The affected product is identified via CPE as cpe:2.3:a:unknown:leadconnector:*:*:*:*:*:*:*:*, indicating versions prior to 3.0.22. The root cause is a missing or inadequate authorization check on a REST endpoint, allowing any HTTP client to invoke the endpoint and modify server-side data. This falls under the authorization/access control vulnerability class, where insufficient permission validation enables privilege escalation from an unauthenticated context to a data-modification context.

RemediationAI

Immediately upgrade the LeadConnector WordPress plugin to version 3.0.22 or later, which patches the authorization bypass. The primary fix is to apply the vendor's official update through the WordPress plugin management interface or by downloading directly from the plugin repository. As an interim mitigation if immediate patching is not feasible, restrict REST API access to authenticated users only via WordPress configuration or web application firewall rules, disable the specific vulnerable endpoint if functionality permits, or implement IP-based access controls to limit who can reach the WordPress site. Review server logs and database audit trails for signs of unauthorized API calls or data modifications. See the WPScan vulnerability reference (https://wpscan.com/vulnerability/9b88be70-b5cc-4a3f-a871-64d61cb02076/) for additional context and confirmation of the patched version.