{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1890", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-02-04T14:26:21.828Z", "datePublished": "2026-03-26T06:00:09.659Z", "dateUpdated": "2026-03-26T13:33:43.195Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-03-26T06:00:09.659Z"}, "title": "LeadConnector < 3.0.22 - Unauthenticated Rest Call", "problemTypes": [{"descriptions": [{"description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "LeadConnector", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "3.0.22"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data"}], "references": [{"url": "https://wpscan.com/vulnerability/9b88be70-b5cc-4a3f-a871-64d61cb02076/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "yi\u011fit ibrahim sa\u011flam", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T13:33:31.155955Z", "id": "CVE-2026-1890", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T13:33:43.195Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-1890", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T13:33:31.155955Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-26T13:33:40.576Z"}}], "cna": {"title": "LeadConnector < 3.0.22 - Unauthenticated Rest Call", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "yi\u011fit ibrahim sa\u011flam"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "LeadConnector", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.22", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/9b88be70-b5cc-4a3f-a871-64d61cb02076/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-03-26T06:00:09.659Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1890", "state": "PUBLISHED", "dateUpdated": "2026-03-26T13:33:43.195Z", "dateReserved": "2026-02-04T14:26:21.828Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2026-03-26T06:00:09.659Z", "assignerShortName": "WPScan"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data"}, {"lang": "es", "value": "El plugin de WordPress LeadConnector anterior a la versi\u00f3n 3.0.22 no tiene autorizaci\u00f3n en una ruta REST, lo que permite a usuarios no autenticados llamarla y sobrescribir datos existentes."}], "id": "CVE-2026-1890", "lastModified": "2026-04-15T15:05:47.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-26T07:16:19.907", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/9b88be70-b5cc-4a3f-a871-64d61cb02076/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Deferred"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0.22)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "LeadConnector", "source": "cna", "vendor": "Unknown"}, "product": "leadconnector", "vendor": "leadconnector"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-27T10:23:58.153081+00:00", "value": {"mitigation_remediation": ["Update the LeadConnector plugin to version 3.0.22 or later.", "If an update is not immediately possible, block or disable the vulnerable REST endpoint using WordPress security plugins or .htaccess rules.", "Verify site integrity to ensure no unauthorized modifications have occurred.", "Schedule a site-wide audit for sensitive data and review settings that may have been altered."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Data Modification"}, "threat_synthesis": {"affected_systems": "WordPress sites that have the LeadConnector plugin installed with a version lower than 3.0.22 are vulnerable. No specific vendor distribution beyond the plugin itself is identified, and the affected versions span all releases prior to 3.0.22.", "description_and_impact": "The LeadConnector WordPress plugin before version 3.0.22 lacks proper authorization on a REST API route, allowing any user with internet access to invoke the route and overwrite existing data. The vulnerability is an instance of improper authorization, which can lead to integrity violations and loss of legitimate business information. By replacing stored records, an attacker can corrupt lead data or sinkholes essential user information, potentially affecting the entire client base.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity. EPSS of less than 1% suggests a low probability of broad exploitation, and the catalog does not list it as a known exploited vulnerability. The attack vector is inferred to be remote and unauthenticated, triggered via a public REST endpoint in the WordPress installation, which the attacker can call without credentials."}}}}, "created": "2026-03-26T11:30:20.434510+00:00", "updated": "2026-03-27T15:47:39.298495+00:00", "vendors": ["leadconnector", "leadconnector$PRODUCT$leadconnector", "wordpress", "wordpress$PRODUCT$wordpress"], "weaknesses": ["CWE-285"]}