Leadsnap
Monthly
Unauthenticated PHP object injection in the LeadSnap WordPress plugin through version 1.25 can let a remote attacker reach a PHP unserialize() path with attacker-influenced data, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-502. The supplied CPE identifies the LeadSnap plugin, and the Patchstack advisory is the sole reference in the provided intelligence; no CISA KEV entry or public exploit code is reported, so no public exploit identified at time of analysis. The C:H/I:H/A:H rating is a worst-case assumption: effects beyond object instantiation depend on a usable POP gadget chain in the plugin or co-installed components, which the available evidence does not confirm.
Unauthenticated PHP object injection in the LeadSnap WordPress plugin through version 1.25 can let a remote attacker reach a PHP unserialize() path with attacker-influenced data, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and CWE-502. The supplied CPE identifies the LeadSnap plugin, and the Patchstack advisory is the sole reference in the provided intelligence; no CISA KEV entry or public exploit code is reported, so no public exploit identified at time of analysis. The C:H/I:H/A:H rating is a worst-case assumption: effects beyond object instantiation depend on a usable POP gadget chain in the plugin or co-installed components, which the available evidence does not confirm.