CVE-2026-25434

26th percentile - higher than 26% of all known CVEs

The WP2LEADS plugin in versions up to and including 3.5.7 contains a SQL Injection vulnerability exploitable by an attacker with subscriber privileges. Insufficient input validation allows injection of malicious SQL queries.

An attacker can read, modify, or delete database data, potentially leading to information disclosure or loss of data integrity. This may also enable privilege escalation within the application.

Update the WP2LEADS plugin to a version newer than 3.5.7 once a fix is released. In the meantime, consider restricting subscriber registration or deploying WAF rules that detect SQL Injection attempts.