CVE-2026-90888

Summary

The LeadSnap WordPress plugin (<=1.25) contains an unauthenticated PHP Object Injection vulnerability (CWE-502), allowing remote attackers to deserialize arbitrary objects via unsanitized user input, potentially leading to remote code execution or data exfiltration without authentication.

Exploitability

Exploitation is straightforward for attackers due to the lack of authentication and direct deserialization of user-controlled data.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, unauthorized data access, and service disruption across any site running the vulnerable plugin version.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to LeadSnap version 1.26 or later, which contains the official patch for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.