SALESmanago EUVD-2026-39364

Exploitation requires an authenticated WordPress session at Subscriber level or higher (PR:L) on a site with the SALESmanago & Leadoo plugin version 3.11.2 or earlier installed and active; no user interaction and no high privileges are needed. The key practical limiter is that the attacker must hold an account - trivially obtained where open registration is enabled, but a genuine barrier where self-registration is disabled or account creation is restricted. The description cites no special non-default plugin configuration; the vulnerable code path is reachable in the plugin's standard installed state, making the account requirement the primary gating condition.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, score 8.5) describes a network-exploitable, low-complexity attack needing only low privileges and no user interaction, with high confidentiality impact and a changed scope. The decisive real-world signal is PR:L combined with the 'Subscriber' qualifier: an account is required, but Subscriber is the lowest tier and many WordPress installs permit open registration, sharply lowering the practical barrier. No EPSS score was provided, the CVE is not in CISA KEV, and no POC was referenced, so this is a credible high-severity issue but is not confirmed for active or widespread exploitation. One inconsistency to verify with the vendor: the published vector lists I:N and only A:L despite SQLi and asserts S:C, whereas a Subscriber-level read-oriented SQLi more typically maps to an unchanged scope dominated by confidentiality impact - so the 8.5 may be conservative or generous depending on whether the injection is blind/error-based or supports stacked/write queries.

An attacker registers or obtains a low-privilege Subscriber account on a WordPress site running the vulnerable plugin, then sends a crafted authenticated request to a plugin action carrying a malicious SQL payload in an unsanitized parameter. The injected query returns or leaks database contents such as administrator password hashes and user data, which can then be cracked offline or used to escalate. No public POC has been identified, but the low attack complexity (AC:L) means a working exploit would be straightforward to develop.