CVE-2026-25434

Summary

This flaw allows SQL injection via subscriber input in WP2LEADS versions 3.5.7 and earlier, enabling attackers to execute arbitrary SQL commands and potentially gain full database access.

Exploitability

Exploitation is relatively straightforward given the SQL injection vulnerability, requiring only that an attacker can submit malicious input through the subscriber interface.

Blast radius

If exploited, this could result in complete compromise of the database, leading to data theft, corruption, or loss.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to WP2LEADS 3.5.8 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.