What is the CVSS score of CVE-2026-54822?

CVE-2026-54822 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of SALESmanago are affected by CVE-2026-54822?

The WordPress SALESmanago & Leadoo plugin (versions 3.11.2 and earlier) contains a SQL injection vulnerability enabling authenticated Subscriber-level users to extract sensitive data from the…

How to fix or mitigate CVE-2026-54822?

Within 24 hours: Inventory all WordPress installations using SALESmanago & Leadoo plugin; document current versions deployed and count of active Subscriber-level users; assess whether the plugin is business-critical. Within 7 days: Either disable the plugin (if functional alternatives exist) or restrict new Subscriber-level user registration; enable database query auditing to monitor for anomalous SQL patterns. Within 30 days: Check Patchstack and vendor advisory channels for patch availability; evaluate alternative CRM/lead-management plugins; if continued use is necessary, deploy Web Application Firewall rules targeting SQL injection attempts against the plugin.

SALESmanago CVE-2026-54822

EUVD-2026-39364 HIGH

SQL Injection (CWE-89)

2026-06-25 Patchstack

GHSA-xwxh-84mx-hgrr

WordPress SQLi Salesmanago Wordpress Plugin Salesmanago Leadoo

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable low-complexity SQLi needs a Subscriber account (PR:L); read-oriented injection gives high confidentiality but no clear integrity or availability impact, and I assess scope unchanged (S:U) versus the vendor's S:C.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:17 vuln.today

DescriptionCVE.org

Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.

AnalysisAI

SQL injection in the WordPress SALESmanago & Leadoo plugin (versions 3.11.2 and earlier) lets authenticated users holding only Subscriber-level privileges inject arbitrary SQL into backend database queries, enabling extraction of sensitive data from the WordPress database. Reported by Patchstack and rated CVSS 8.5, it is dangerous because Subscriber is the lowest authenticated role and is frequently self-registerable on WordPress sites. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Technical ContextAI

This is a CWE-89 SQL Injection in a WordPress plugin that integrates the SALESmanago marketing-automation platform with the Leadoo lead-generation toolset. Per the affected CPE (cpe:2.3:a:salesmanago:salesmanago_&_leadoo:*), the flaw resides in plugin PHP code where user-controllable input is concatenated into a SQL statement without proper parameterization or escaping (e.g., a missing $wpdb->prepare() call or an unescaped request parameter). Because WordPress plugins run with full database access through the shared $wpdb connection, an injectable query exposes the entire wp_ schema, including wp_users and wp_usermeta where password hashes and account metadata are stored.

RemediationAI

Upgrade the SALESmanago & Leadoo plugin to a release newer than 3.11.2 as published by the vendor; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/salesmanago/vulnerability/wordpress-salesmanago-leadoo-plugin-3-11-2-sql-injection-vulnerability) for the exact fixed version, since no patched version number was provided in the available data and should not be assumed. Until patched, the most effective compensating control is to disable open user registration (Settings > General > uncheck 'Anyone can register') to remove the easy path to a Subscriber account the exploit depends on, accepting that legitimate self-service signups are then blocked. Additionally deploy a WAF rule (such as Patchstack's virtual patch or a generic SQLi ruleset) in front of the plugin's endpoints, audit and remove untrusted low-privilege accounts, and if the plugin is non-essential, deactivate it entirely until a fix is applied.