CVE-2026-25433: CWE-862 Missing Authorization in Tobias @Saleswonder.biz WP2LEADS

This vulnerability is a missing authorization (CWE-862) in WP2LEADS plugin versions up to 3.5.7, which allows an attacker with low privileges to access subscriber-related functions without proper authorization. The CVSS 3.1 vector indicates network attack vector, low complexity, privileges required are low, no user interaction needed, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. No vendor advisory or patch details are available to confirm remediation status.

An attacker with low privileges can exploit this vulnerability remotely to gain unauthorized access to subscriber-related data or functionality, potentially leading to disclosure of sensitive information (high confidentiality impact). The integrity of data is not affected, and availability impact is low, possibly causing minor service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin functionality and monitor for suspicious activity related to subscriber access. Avoid granting unnecessary privileges to users.