Wp2Leads Wordpress Und Klicktipp Einfach Verbinden Woocommerce Und Klicktipp Einfach Verbinden
Monthly
Time-based blind SQL injection in the WP2LEADS plugin for WordPress (all versions up to and including 3.5.6) lets an authenticated user holding Subscriber-level access or higher inject arbitrary SQL through the 'order' parameter and extract sensitive data from the site database. Exploitation requires a valid low-privileged account, so it is realistically reachable on sites that allow user self-registration or where an attacker already holds credentials; the blind, time-based extraction method makes data theft slow and produces measurable server-side delays. There is no CISA KEV listing and no public exploit identified at time of analysis, and the source data carries a 'this_month' priority label rather than an emergency rating.
Time-based blind SQL injection in the WP2LEADS plugin for WordPress (all versions up to and including 3.5.6) lets an authenticated user holding Subscriber-level access or higher inject arbitrary SQL through the 'order' parameter and extract sensitive data from the site database. Exploitation requires a valid low-privileged account, so it is realistically reachable on sites that allow user self-registration or where an attacker already holds credentials; the blind, time-based extraction method makes data theft slow and produces measurable server-side delays. There is no CISA KEV listing and no public exploit identified at time of analysis, and the source data carries a 'this_month' priority label rather than an emergency rating.