EUVD-2026-93228
GHSA-7wr8-q9hw-xw46
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister or obtain Subscriber account
-
DeliveryAuthenticate to WordPress site
-
ExploitInvoke plugin endpoint lacking authorization check
-
ExecutionAccess restricted WP2LEADS data/function
-
ImpactExfiltrate sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated account at WordPress Subscriber privilege level or higher on a site running the WP2LEADS plugin version 3.5.7 or earlier (per PR:L and the 'Subscriber Broken Access Control' description). The practical limiting factor is account access: the attack is realistic on sites that permit open/self-service user registration (very common in WordPress) but is gated on sites that restrict account creation. No special non-default plugin configuration is indicated by the available data, and no user interaction is required (UI:N). |
| Impact | This is a genuine but moderate-priority issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base 7.1) indicates a network-reachable flaw that is low-complexity and requires no user interaction, but critically needs authentication: PR:L corresponds to a low-privileged (Subscriber) account, which matches the description's 'Subscriber Broken Access Control.' Impact is weighted toward confidentiality (C:H) with a minor availability effect (A:L) and no integrity impact (I:N). No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is NOT listed in CISA KEV and no public POC is referenced, so there is no evidence of active or imminent widespread exploitation. The single source is a Patchstack advisory. Net assessment: a real, patch-worthy authorization flaw whose practical risk is bounded by the need for a valid Subscriber account on a site running the specific WP2LEADS plugin - meaningful on sites that allow open user registration, lower risk on sites that do not. No signals conflict, but several (EPSS, KEV, POC) are simply absent, so this is a severity rating without corroborating exploitation telemetry. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privileged Subscriber account on a WordPress site running WP2LEADS 3.5.7 or earlier, then invokes a plugin function that fails to verify the caller's authorization level. This lets the Subscriber read data or trigger plugin actions that should be restricted to higher-privileged roles, exposing sensitive confidentiality-relevant information. No public exploit code is identified at time of analysis, and the attack requires an authenticated session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Broken access control in the WP2LEADS WordPress plugin through version 3.5.7 lets any authenticated user holding a Subscriber-level account invoke plugin functionality that should be reserved for privileged roles, resulting in unauthorized disclosure of confidential data (CVSS 7.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). The plugin is the lead-capture/CRM-sync extension published by Tobias (@saleswonder.biz); the practical gating factor is account acquisition, so sites that permit open or self-service registration are the most realistically exposed while sites requiring manual account approval are largely shielded. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but moderate-priority exposure rather than an emergency.
RemediationAI
Upgrade WP2LEADS to a release newer than 3.5.7 as the primary fix; the available data identifies 3.5.7 as the last affected version but does not enumerate an exact patched version number, so the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-5-7-broken-access-control-vulnerability?_s_id=cve should be checked to confirm the released fix build, and if no tagged patched release is yet confirmed the plugin should be treated as unpatched. If upgrading is not immediately possible, the highest-value compensating control is to deactivate the plugin (eliminates the vulnerable handler entirely, at the cost of losing lead capture and CRM synchronization until a fix ships). A second actionable measure is to close self-service registration under WordPress Settings > General or restrict it to trusted invitees, which denies attackers the Subscriber account the exploit requires - this reduces but does not eliminate risk, since any already-registered low-privilege account retains access. Audit existing Subscriber accounts for suspicious or automated sign-ups, and as a last resort deploy a WAF or server rule to block low-privilege requests to the plugin's AJAX/REST endpoints, accepting that such a rule can produce false positives for legitimate administrative traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 Missing Authorization, the untagged condition in which a plugin registers a function, AJAX handler, or REST/admin-ajax.php action without enforcing a current_user_can() capability check on it. In the WordPress privilege model the Subscriber role is the lowest authenticated tier - it exists solely to grant a logged-in identity (commenting, profile access) and normally carries no administrative capability - so any endpoint that a Subscriber can reach and that performs privileged work is by definition under-authorized. The CVSS vector PR:L confirms that low-privilege authentication, not anonymous access, is sufficient, and C:H records that the confidentiality loss is high while A:L indicates limited availability impact, consistent with a handler that returns or exports stored lead/subscriber records rather than one that alters site configuration. Because the tag set pairs "WordPress" with "Authentication Bypass" and CPE cpe:2.3:a:tobias_@saleswonder.biz:wp2leads identifies the plugin generically across its version history, the affected artifact is the plugin itself rather than the WordPress core installation; the advisory was filed by Patchstack, whose WordPress database entries typically map a function-level missing-capability-check to this CWE.
Know when Wp2Leads gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Requires an authenticated Subscriber account so PR:L (not PR:N); network-reachable and low-complexity with no interaction; impact is primarily confidentiality disclosure with minor availability and no integrity effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
Executive ViewAI
WP2LEADS, a WordPress lead-capture and CRM-sync plugin, through version 3.5.7 contains a broken access control flaw that lets any authenticated Subscriber-level user retrieve confidential lead or CRM data they should not access. Organizations with open or self-service WordPress registration are most exposed, while sites requiring manual account approval are largely shielded; no public exploit identified at time of analysis and the issue is not in CISA KEV. Leadership should prioritize inventory and interim containment because no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing WP2LEADS until a fixed version is released, and if the plugin is business-critical, disabling open/self-service registration, restricting Subscriber account creation and privileges, reviewing existing Subscriber accounts, blocking low-privilege access to plugin endpoints via WAF or virtual patching, and monitoring logs for unauthorized lead/CRM data access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB