/Vulnerability Library

LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write

CVE-2026-1890
Verified

Description

LeadConnector WordPress plugin < 3.0.22 contains a broken access control caused by missing authorization in a REST route, letting unauthenticated attackers overwrite existing data remotely, exploit requires no authentication.

Severity

Medium

CVSS Score

5.3

Exploit Probability

1%

Affected Product

leadconnector

Published Date

July 2, 2026

Template Author

0x_akoko

CVE-2026-1890.yaml
5.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE ID:
cve-2026-1890
CWE ID:
cwe-862

References

https://wpscan.com/vulnerability/9b88be70-b5cc-4a3f-a871-64d61cb02076/https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1890

Remediation Steps

Update to version 3.0.22 or later.