What is the CVSS score of CVE-2026-78268?

CVE-2026-78268 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

How to fix or mitigate CVE-2026-78268?

Within 24 hours: Audit all WordPress installations to identify those running SiteLeads plugin versions 1.2.0 or earlier, and document the scope of affected sites and their data exposure. Within 7 days: Implement interim controls by disabling or removing the plugin from all affected installations, rotating any API credentials or sensitive configuration that may have been exposed, and establishing monitoring for unauthorized access patterns. Within 30 days: Monitor the SiteLeads project and WordPress plugin repository for patch releases; upon vendor patch availability to version 1.2.1 or later, establish a testing and deployment schedule to systematically update all affected installations.

SiteLeads CVE-2026-78268

EUVD-2026-65175 HIGH

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-08-24 Patchstack

GHSA-pvch-mwpv-4j95

WordPress Information Disclosure Wordpress Plugin Lead Generation Contact Widget Amp Ai Chatbot Extend Themes

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site via scanning
Delivery

Detect SiteLeads plugin presence
Exploit

Send unauthenticated HTTP request to plugin endpoint
Execution

Receive sensitive data in response
Impact

Harvest lead records or API credentials

Vulnerability Assessment

Weakness	CWE CWE-497 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection System info exposure prevention
Exploitation Conditions	No special conditions are required for exploitation. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote, unauthenticated exploitation against any internet-accessible WordPress installation running SiteLeads version 1.2.0 or earlier with the plugin active. The primary limiting factor is plugin deployment scope - only sites that have specifically installed and activated this plugin are affected. Sites behind authenticated reverse proxies, VPNs, or IP allowlists restricting WordPress access would reduce external exposure, but these are non-default configurations that would need to be intentionally in place.
Impact	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a straightforward, network-accessible, zero-authentication attack with high confidentiality impact and no complexity barrier - any internet-exposed WordPress site running the affected plugin version is reachable by an opportunistic scanner. No EPSS score was provided in the source data, which limits probabilistic exploitation forecasting. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, suggesting exploitation has not yet reached widespread automated abuse. Despite the high CVSS score, real-world priority should be modulated by the plugin's limited deployment footprint - this is a niche lead-generation plugin rather than a core WordPress component, reducing aggregate exposure. Integrity and availability are unaffected, so the primary business risk is leakage of contact/lead data and potential exposure of third-party API credentials (e.g., Telegram bot tokens, AI service keys) embedded in plugin configuration. Even a mid-sized municipal IT team in malbork managing a community engagement WordPress site should treat discovery of this plugin as a prompt upgrade trigger, given that CRM lead data and API secrets carry regulatory and reputational weight disproportionate to the plugin's obscurity.
Exploit ScenarioDerived	An attacker performs an unauthenticated HTTP GET or POST request to a WordPress REST API or AJAX endpoint registered by the SiteLeads plugin, requiring no credentials or session tokens. The plugin returns sensitive data - potentially captured lead contact records or embedded API keys - directly in the response. Because the attack requires no authentication and no user interaction, automated scanners probing WordPress installations for vulnerable plugin versions can trivially harvest this data at scale.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 24, 2026

Unauthenticated sensitive data exposure in the SiteLeads WordPress plugin (Lead Generation Contact Widget & AI Chatbot) versions 1.2.0 and earlier allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. The vulnerability stems from improper protection of sensitive system data (CWE-497), where plugin-stored data - likely including lead contact details, API credentials, or configuration values - is accessible without authentication. No public exploit or CISA KEV listing has been identified at the time of analysis, though the CVSS score of 7.5 (High) reflects the low-effort, network-accessible nature of the attack.

RemediationAI

WordPress site operators running SiteLeads should update the plugin to a version beyond 1.2.0 immediately; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/siteleads/vulnerability/wordpress-lead-generation-contact-widget-ai-chatbot-chat-button-phone-call-telegram-email-siteleads-plugin-1-2-0-sensitive-data-exposure-vulnerability should be consulted to confirm the exact patched release version, as an explicit fixed version number was not confirmed in the available source data. If an update is not immediately available or cannot be applied, the plugin should be deactivated entirely to eliminate the exposed endpoint - leaving an unpatched plugin installed but inactive does not remove registered REST or AJAX hooks in all WordPress configurations, so full deactivation is preferred. Additionally, any API credentials (Telegram bot tokens, AI service API keys) stored in the plugin's configuration should be treated as potentially compromised and rotated, as these may have been accessible to unauthenticated parties. A web application firewall rule blocking requests to the specific plugin endpoint could serve as a short-term compensating control, but identifying the exact endpoint requires inspection of the plugin source.

Affected VersionsENISA

Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads n/a ≤1.2.0

Affected Packages

euvd lead_generation_contact_widget_amp_ai_chatbot_chat_button_phone_call_telegram_email_siteleads no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected product is the 'Lead Generation Contact Widget & AI Chatbot' WordPress plugin by Extend Themes, marketed as SiteLeads, as confirmed by CPE cpe:2.3:a:extend_themes:lead_generation_contact_widget_&_ai_chatbot:*. The plugin provides contact widget, AI chatbot, Telegram integration, phone call, and email lead capture functionality for WordPress sites. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) indicates that sensitive runtime or stored data - such as captured lead records, API tokens for Telegram or AI services, or internal configuration - is being returned to callers who have no legitimate access. This class of flaw typically arises when REST API endpoints or AJAX handlers registered by the plugin fail to apply capability checks or nonce verification before returning data, a common pattern in vulnerable WordPress plugins.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Network-accessible unauthenticated endpoint exposes sensitive data; no integrity or availability impact is described or inferable from the vulnerability class.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email - SiteLeads <= 1.2.0 versions.

Executive ViewAI

Why It Matters

The SiteLeads WordPress plugin (versions 1.2.0 and earlier) contains an unauthenticated vulnerability allowing remote attackers to access sensitive data including lead contact information and API credentials. Any WordPress site using this plugin exposes customer lead data and system credentials to unauthorized access without requiring authentication. Organizations should immediately identify affected installations and restrict plugin access pending patch release.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable or remove the plugin from all WordPress installations pending patch availability, implement Web Application Firewall (WAF) rules to restrict access to plugin endpoints, audit and rotate all API credentials and sensitive configuration values that may have been exposed, and establish continuous monitoring for unauthorized access attempts. Subscribe to WordPress plugin security advisories for patch notification.

Threat Intelligence Overview

EPSS Score

0.2%

Top 84% exploitable

Prevalence

Low

niche WordPress lead-generation plugin with limited known deployments

Social Media

Sightings

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.