Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.
Published: 2026-01-22
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The wp‑lead-capture plugin contains a blind SQL injection flaw caused by improper escaping of special characters in database queries, allowing an attacker to inject malicious SQL through user‑controlled inputs and pull or modify sensitive data, potentially compromising confidentiality and data integrity.

Affected Systems

All released versions of the WordPress WP Lead Capturing Pages plugin built by kamleshyadav up to and including 2.5 are affected. Upgrading to a newer version removes the vulnerability.

Risk and Exploitability

The CVSS score of 9.3 classifies this as a critical issue, yet the current EPSS score of less than 1% indicates low exploitation probability today. The flaw is not listed in CISA KEV, so no widespread exploitation is reported. The probable attack vector is through publicly accessible form fields processed by the plugin, though the exact exploitation pathway is inferred from the description.

Generated by OpenCVE AI on April 30, 2026 at 04:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the WP Lead Capturing Pages plugin to a version newer than 2.5 to eliminate the vulnerability.
  • If an upgrade is not possible, deactivate and remove the plugin to remove the attack surface.
  • Limit database user privileges for the WordPress installation to the minimum needed and ensure all input from the plugin is properly sanitized or parameterized as an additional safeguard.
  • Configure a web application firewall to detect and block SQL injection patterns against the plugin's endpoints for extra protection.

Generated by OpenCVE AI on April 30, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Apr 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Mon, 26 Jan 2026 23:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 22 Jan 2026 23:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.
Title WordPress WP Lead Capturing Pages plugin <= 2.5 - SQL Injection vulnerability
Weaknesses CWE-89
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:58.147Z

Reserved: 2025-05-30T14:04:34.998Z

Link: CVE-2025-49055

cve-icon Vulnrichment

Updated: 2026-01-26T22:00:17.355Z

cve-icon NVD

Status : Deferred

Published: 2026-01-22T17:15:55.903

Modified: 2026-04-27T20:16:10.463

Link: CVE-2025-49055

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T04:30:27Z

Weaknesses