CVE-2026-25433
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Broken Access Control vulnerability in WP2LEADS up to version 3.5.7 allows a subscriber to gain unauthorized access to functions they should not have permissions for.
Risk Assessment
A subscriber could access sensitive data or administrative functions, potentially leading to confidentiality and integrity breaches.
Recommendation
Update the WP2LEADS plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in WP2LEADS
See all- CVE-2025-9462Medium
The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in versions up to and including 3.5.6 due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to extract sensitive information from the database.
- CVE-2026-25434High
The WP2LEADS plugin in versions up to and including 3.5.7 contains a SQL Injection vulnerability exploitable by an attacker with subscriber privileges. Insufficient input validation allows injection of malicious SQL queries.
Original NVD description (English source)
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS