LeadSnap CVE-2026-90888

Requires a target running the LeadSnap WordPress plugin at version 1.25 or earlier, with the vulnerable code path reachable by an unauthenticated remote request (consistent with PR:N/UI:N). The specific endpoint, parameter, or feature that passes attacker input to unserialize() is not described in the available sources. A critical practical limiter not quantified in the input: realized impact beyond object instantiation (RCE/file/SQL effects) generally depends on a usable POP gadget chain being present in the plugin or co-installed components - the evidence does not confirm one exists, so the full C:H/I:H/A:H impact is a worst-case assumption rather than a verified outcome.

Signals are largely aligned toward high priority but rest on a single source. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today decision label is act_now. However, several real-risk signals are absent from the input: there is no EPSS probability, no CISA KEV listing, and no confirmed public exploit code - the only reference is a Patchstack advisory page, not a working PoC. So the urgency is driven by severity rating and vendor triage rather than by observed exploitation. PHP Object Injection (CWE-502) is a genuinely dangerous class, but practical impact (RCE, arbitrary file operations, SQL injection, etc.) typically depends on a usable POP gadget chain being reachable in the plugin or co-installed code; the available evidence does not confirm which concrete impact is achievable, so the uniform C:H/I:H/A:H should be treated as a worst-case rating, not a demonstrated outcome. Net: following the act_now label this warrants prompt remediation, but the absence of EPSS/KEV/PoC data means confidence that it is being exploited at scale is low and should not be overstated.

A remote attacker sends a crafted request to a vulnerable LeadSnap endpoint containing an attacker-controlled serialized PHP object, which the plugin passes to unserialize() without authentication. If a suitable POP gadget chain is reachable in the plugin or the WordPress environment, this can escalate to code execution, file manipulation, or data compromise. No confirmed working public exploit was identified in the provided data; the only reference is a Patchstack advisory entry.