CVE-2026-4375
CriticalCVSS 9.0Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The DoLeads Integrator and wp2epub WordPress plugins (versions up to 0.65) allow remote code execution (RCE) once installed on a blog. The vulnerability stems from the ability to install extensions from wordpress.org by unauthorized users.
Risk Assessment
An attacker can take over the WordPress server by installing malicious extensions and executing arbitrary code, leading to full compromise of the site and its data.
Recommendation
Immediately remove the DoLeads Integrator and wp2epub plugins in versions up to 0.65. Update them to the latest versions if available, and restrict extension installation privileges to trusted administrators only.
Original NVD description (English source)
The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users.