CVE-2026-25434: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Tobias @Saleswonder.biz WP2LEADS

This vulnerability, identified as CWE-89, exists in WP2LEADS versions up to 3.5.7. It is caused by improper neutralization of special elements used in SQL commands, enabling SQL Injection attacks. The CVSS 3.1 score is 8.5, indicating a high severity with network attack vector, low attack complexity, low privileges required, no user interaction, and scope changed. The impact includes high confidentiality impact, no integrity impact, and low availability impact. No known exploits in the wild or vendor patches are currently documented.

An attacker with low privileges can exploit this vulnerability remotely without user interaction to execute unauthorized SQL commands. This can lead to significant confidentiality breaches of the database and partial disruption of service availability. Integrity is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider restricting access to the affected component and applying any available workarounds recommended by the vendor.