CVE-2026-10835 describes a SQL injection vulnerability in the SALESmanago & Leadoo WordPress plugin prior to version 3.11.3. The issue arises because the plugin does not properly sanitize and escape a parameter passed to one of its AJAX actions before incorporating it into a SQL query. Furthermore, the plugin does not enforce authorization checks on this AJAX action, permitting authenticated users with minimal privileges to perform SQL injection attacks. No CVSS score or patch information is currently available.

Exploitation of this vulnerability could allow authenticated users with minimal permissions to execute arbitrary SQL commands on the backend database. This may lead to unauthorized data access, data modification, or other database-related impacts depending on the attacker's intent and database configuration. The lack of authorization enforcement increases the risk by enabling low-privilege users to exploit the flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to limit access to the vulnerable AJAX action. Monitor vendor channels for updates regarding patches or official mitigations.