EUVD-2026-93229
GHSA-jppq-xq3m-m5cp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain Subscriber account
-
ExploitSend crafted request to WP2LEADS endpoint
-
ExecutionInject SQL via unsanitized parameter
-
ImpactExtract database contents (users, hashes, secrets)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated WordPress account with at least Subscriber-level privileges (PR:L) on a site running WP2LEADS version 3.5.7 or earlier, where the injection reaches a plugin parameter that is not properly sanitized. The main limiting factor is the authentication requirement: the attacker must be able to register or already hold an account, so sites that disable open user registration substantially reduce exposure. No victim user interaction is needed (UI:N), and the vulnerable endpoint is reachable over the network (AV:N) against the plugin's default configuration once authenticated. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, score 8.5) describes a network-reachable, low-complexity SQL injection requiring only low-privilege (PR:L) authentication, which aligns with the description's 'Subscriber SQL Injection' - meaning any registered Subscriber-level account can trigger it, a very low bar on sites that allow open user registration. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so exploitation status is: no public exploit identified at time of analysis. This is a genuine but second-tier priority: the high CVSS is driven by the easy authentication bar and database confidentiality impact, not by any evidence of real-world weaponization. The I:N (no integrity impact) and A:L in the vendor vector suggest Patchstack assessed this as a primarily read-oriented injection rather than full data manipulation. The S:C (scope change) claim is debatable for a plugin-level SQLi and is a point of uncertainty - see confidence notes. Absent EPSS/KEV signals, treat this as a 'patch in the normal cycle, prioritize where the site permits open registration' issue rather than an emergency. |
| Exploit ScenarioDerived | An attacker registers (or compromises) a low-privilege Subscriber account on a WordPress site running WP2LEADS <= 3.5.7, then sends a crafted authenticated request to a vulnerable plugin endpoint with injected SQL in a parameter. The low attack complexity (AC:L) means the injection succeeds reliably, allowing extraction of sensitive database contents such as user credentials and WordPress secrets. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Authenticated SQL injection in WP2LEADS plugin versions 3.5.7 and earlier allows any Subscriber-level user to execute arbitrary SQL queries, resulting in high confidentiality impact and low integrity/availability impact. The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and requires only low-privilege authentication (PR:L), making sites with open user registration particularly at risk. No public exploit identified at time of analysis.
RemediationAI
No vendor-released patch is identified in the available data. As a compensating control, restrict the ability for untrusted users to obtain Subscriber-level accounts by disabling open user registration or requiring manual approval. Additionally, consider temporarily deactivating or removing the WP2LEADS plugin until a fix is available, as this eliminates the vulnerable code path. Monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-5-7-sql-injection-vulnerability?_s_id=cve for patch updates. Note that disabling registration may impact legitimate users, and removing the plugin may disrupt site functionality; weigh these trade-offs against the risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a SQL injection (CWE-89) in the WP2LEADS WordPress plugin, caused by insufficient sanitization of user-supplied input before it is used in SQL queries. The plugin, developed by Tobias @ saleswonder.biz, is affected in all versions up to and including 3.5.7 per the CPE string cpe:2.3:a:tobias_@saleswonder.biz:wp2leads:*:*:*:*:*:*:*:* and the advisory. The injection is reachable by any authenticated user with Subscriber-level privileges, the lowest role in WordPress, meaning an attacker only needs a valid account on the site. The independent assessment assigns a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, indicating high confidentiality impact but limited integrity and availability impact, with no scope change. This contrasts with the originally reported vector that indicated scope change and no integrity impact, but the assessed vector reflects the confirmed impact.
Know when Wp2Leads gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Subscriber auth gives PR:L, network/low-complexity injection (AV:N/AC:L); SQLi read access yields C:H with limited I/A, and scope stays within the database security authority so S:U.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
Executive ViewAI
A high-severity SQL injection flaw in the WP2LEADS WordPress plugin (versions 3.5.7 and earlier) allows any user holding only a basic Subscriber account to extract data directly from the site's database. Because Subscriber accounts are typically self-service on sites with open registration, this weakness effectively lowers the barrier to database compromise to anyone willing to sign up, and no vendor fix is currently available. Leadership should care because affected WordPress sites may hold customer records, credentials, and marketing data whose exposure carries regulatory, contractual, and reputational consequences.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the WP2LEADS plugin where feasible; disable open/self-service user registration and restrict Subscriber account creation; audit and remove dormant or unnecessary low-privilege accounts; enforce least-privilege database accounts for the WordPress application; deploy WAF rules to block SQL injection patterns targeting the plugin; and enable database and web application logging with alerting for anomalous query behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Exploit-DB