CVE-2026-39657
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The leadlovers-forms WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.0.2.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or data, potentially leading to privilege escalation and system integrity compromise.
Recommendation
Immediately update the leadlovers-forms plugin to the latest available version and verify access control configuration.
Original NVD description (English source)
Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects leadlovers forms: from n/a through <= 1.0.2.