Critical
Critical vulnerability in LeadSnap plugin for WordPress
WordPress
What happened
A critical unauthenticated PHP object injection vulnerability has been found in the LeadSnap plugin for WordPress.
Are you affected?
The LeadSnap plugin for WordPress, version 1.25 and earlier may be affected.
What to do now
- Upgrade to a patched version of the LeadSnap plugin as soon as possible.
- Regularly review your plugins for vulnerabilities and keep them updated.
- Consider implementing monitoring for any unexpected behavior in your WordPress site.
Sources
- cve.now/CVE-2026-90888
- cve.now/GHSA-27wj-mp2h-85jg
- CVE-2026-90888
- GHSA-27wj-mp2h-85jg
- https://nvd.nist.gov/vuln/detail/CVE-2026-90888
- https://patchstack.com/database/wordpress/plugin/leadsnap/vulnerability/wordpress-leadsnap-plugin-1-25-php-object-injection-vulnerability?_s_id=cve
Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.
This product uses data from the NVD API but is not endorsed or certified by the NVD.
Not sure if your app is affected?
Get a free Finish Line Scan and a senior engineer will tell you what to fix.
Get a free scan