WP2LEADS EUVD-2025-211229

Requires an authenticated WordPress account with Subscriber-level privileges or above on a site running the WP2LEADS plugin version 3.5.6 or earlier; the attacker supplies a malicious value in the 'order' parameter reaching the vulnerable query in MapBuilderManager.php. Exploitation is limited by the authentication prerequisite - realistically relevant only where user self-registration is enabled or the attacker already possesses low-level credentials - and by the time-based blind nature of the flaw, which makes data extraction slow and generates measurable server-side delays. No special non-default configuration beyond the plugin being installed and active is indicated in the available sources.

This is a moderate-severity, authenticated SQL injection (CWE-89) with a coherent set of signals pointing to a real-but-not-urgent issue. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates remote, low-complexity exploitation but requires authentication (PR:L - Subscriber-level and above), with impact limited to confidentiality (C:H; I:N/A:N - read-only data disclosure, no write or availability impact). The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a prioritize-but-not-drop-everything posture. No EPSS score, no CISA KEV listing, and no verified public exploit code are present in the input, so there is no evidence of active exploitation or widespread automated attack. The main mitigating factor is the authentication requirement: an attacker needs at least a Subscriber account, which lowers real-world risk on sites that do not allow open user registration. The dependency on a low-privilege-but-still-valid account, combined with the time-based blind extraction technique (slow, noisy data exfiltration) and a niche plugin footprint, means this is a legitimate fix-this-cycle item rather than a high-urgency emergency. EPSS and PoC-availability data are absent and should be confirmed with Wordfence/vendor before final prioritization.

An attacker who holds or self-registers a Subscriber-level account on a WordPress site running WP2LEADS ≤3.5.6 submits a crafted value in the 'order' parameter that is concatenated into an unprepared SQL query. Because the injection is time-based blind, the attacker infers database contents (e.g., user records, credentials, secrets) one condition at a time by measuring server response delays. No public exploit code is identified in the input, and no user interaction beyond the attacker's own authenticated request is needed.