Wp2Leads
Monthly
Authenticated SQL injection in WP2LEADS plugin versions 3.5.7 and earlier allows any Subscriber-level user to execute arbitrary SQL queries, resulting in high confidentiality impact and low integrity/availability impact. The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and requires only low-privilege authentication (PR:L), making sites with open user registration particularly at risk. No public exploit identified at time of analysis.
Broken access control in the WP2LEADS WordPress plugin through version 3.5.7 lets any authenticated user holding a Subscriber-level account invoke plugin functionality that should be reserved for privileged roles, resulting in unauthorized disclosure of confidential data (CVSS 7.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). The plugin is the lead-capture/CRM-sync extension published by Tobias (@saleswonder.biz); the practical gating factor is account acquisition, so sites that permit open or self-service registration are the most realistically exposed while sites requiring manual account approval are largely shielded. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but moderate-priority exposure rather than an emergency.
Authenticated SQL injection in WP2LEADS plugin versions 3.5.7 and earlier allows any Subscriber-level user to execute arbitrary SQL queries, resulting in high confidentiality impact and low integrity/availability impact. The vulnerability is network-reachable (AV:N) with low attack complexity (AC:L) and requires only low-privilege authentication (PR:L), making sites with open user registration particularly at risk. No public exploit identified at time of analysis.
Broken access control in the WP2LEADS WordPress plugin through version 3.5.7 lets any authenticated user holding a Subscriber-level account invoke plugin functionality that should be reserved for privileged roles, resulting in unauthorized disclosure of confidential data (CVSS 7.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). The plugin is the lead-capture/CRM-sync extension published by Tobias (@saleswonder.biz); the practical gating factor is account acquisition, so sites that permit open or self-service registration are the most realistically exposed while sites requiring manual account approval are largely shielded. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but moderate-priority exposure rather than an emergency.