The plugin fails to sanitise and escape a parameter used in an SQL statement and does not enforce authorisation on the corresponding AJAX action. Consequently, authenticated users with minimal permissions, such as subscribers, can inject arbitrary SQL code. If successful, an attacker could read, modify, or delete database records, potentially compromising site confidentiality, integrity, and availability.

WordPress installations that have the SALESmanago & Leadoo plugin version earlier than 3.11.3. The vulnerability applies to any instance of the plugin where the AJAX action is accessible to users with subscriber or equivalent roles.

The gap in input sanitisation coupled with missing authorisation creates a high‑risk vector. Although the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the inherent nature of unauthorised SQL injection carries a severe potential impact. An attacker who already has a low‑privilege account can exploit the exposed endpoint via familiar AJAX request patterns, making the likelihood of exploitation substantial in environments that allow many user registrations.