CVE-2026-25434
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The WP2LEADS plugin in versions up to and including 3.5.7 contains a SQL Injection vulnerability exploitable by an attacker with subscriber privileges. Insufficient input validation allows injection of malicious SQL queries.
Risk Assessment
An attacker can read, modify, or delete database data, potentially leading to information disclosure or loss of data integrity. This may also enable privilege escalation within the application.
Recommendation
Update the WP2LEADS plugin to a version newer than 3.5.7 once a fix is released. In the meantime, consider restricting subscriber registration or deploying WAF rules that detect SQL Injection attempts.
Other vulnerabilities in WP2LEADS
See all- CVE-2025-9462Medium
The WP2LEADS plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in versions up to and including 3.5.6 due to insufficient escaping of user-supplied input and lack of proper preparation of the SQL query. An authenticated attacker with subscriber-level access or higher can append additional SQL queries to extract sensitive information from the database.
- CVE-2026-25433High
Broken Access Control vulnerability in WP2LEADS up to version 3.5.7 allows a subscriber to gain unauthorized access to functions they should not have permissions for.
Original NVD description (English source)
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS