CVE-2026-1890
published 2026-03-26CVE-2026-1890: The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing…
PriorityP180medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.24%
15.1th percentile
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vulncheck5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-795h-9vq2-6x3x: The LeadConnector WordPress plugin before 3
ghsa_unreviewed·2026-03-26
CVE-2026-1890 [MEDIUM] GHSA-795h-9vq2-6x3x: The LeadConnector WordPress plugin before 3
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
VulnCheck
Vulnerability
vulncheck·2026·CVSS 5.3
CVE-2026-1890 [MEDIUM] Vulnerability
The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://patchstack.com/database/wordpress/plugin/leadconnector/vulnerability/wordpress-leadconnector-plugin-3-0-22-unauthenticated-rest-call-vulnerability
No detection rules found.
No public exploits indexed.
2026-03-26
Published
Exploited in the wild