CVE-2026-25433

HighCVSS 7.1

Published: 06/10/2026(UTC)Updated: 06/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

26th percentile - higher than 26% of all known CVEs

Summary

Broken Access Control vulnerability in WP2LEADS up to version 3.5.7 allows a subscriber to gain unauthorized access to functions they should not have permissions for.

Risk Assessment

A subscriber could access sensitive data or administrative functions, potentially leading to confidentiality and integrity breaches.

Recommendation

Update the WP2LEADS plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in WP2LEADS

CVE-2026-25434High
The WP2LEADS plugin in versions up to and including 3.5.7 contains a SQL Injection vulnerability exploitable by an attacker with subscriber privileges. Insufficient input validation allows injection of malicious SQL queries.

Original NVD description (English source)

Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS