5.3 Medium

CVE-2026-1890 The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated…

Description

The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data

Affected products and versions

Product	Affected versions	Fixed in
LeadConnector 3.0	earliest → < 3.0.22	3.0.22

Do you use LeadConnector?

Track this CVE Watch LeadConnector Check my SBOMs

www.cveye.io/en/cve/CVE-2026-1890

Timeline

Published March 26, 2026
Last modified March 26, 2026

References

wpscan.com wpscan.com

Track this CVE