The WP2LEADS WordPress plugin contains a time‑based SQL injection vulnerability that is exercised through the order parameter in multiple internal calls. The vulnerability exists because the plugin concatenates the order value directly into a SQL query without adequate escaping or prepared statement use. Because the flaw accepts a user supplied string, an attacker with Subscriber‑level access or higher can embed arbitrary SQL fragments, allowing the extraction of sensitive information from the database. This flaw is a classic example of CWE‑89: Improper Neutralization of Special Elements used in an SQL Command.

Affected systems are WordPress sites that have the WP2LEADS plugin from vendor tobias_conrad installed at any version up to and including 3.5.6. The issue is present in every release before the fix was released in the 3.5.7 update, and it impacts the entire plugin code base. Sites that have upgraded to newer versions are not vulnerable.

The reported CVSS score is 6.5, indicating a moderate severity. No EPSS score is available and the CISA KEV catalog does not list this vulnerability, which suggests that exploit data is not yet widely observed. The exploit requires an authenticated user with Subscriber role or higher, meaning the attacker must first obtain site credentials or compromise an existing account. Once authenticated, the attacker can trigger the injection through the plugin’s UI, extending the existing SQL query and reading data otherwise inaccessible to that role. Given the lack of a public exploit and the need for authentication, the immediate risk is moderate but could become high if credentials are compromised or the plugin is used on a multi‑tenant hosting environment.