WordPress WP2LEADS plugin suffers an Incorrect Privilege Assignment flaw that can be abused to elevate a user’s privileges. The vulnerability allows a user with sufficient access to assign higher authority to themselves or others, compromising the integrity and confidentiality of the site.

The affected vendor product is the WordPress WP2LEADS plugin developed by Tobias. All releases up to and including version 3.5.17 are vulnerable; the issue applies from n/a through 3.5.17.

The CVSS score of 7.3 indicates high severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. Attackers would typically need access to the WordPress admin interface or the WP2LEADS dashboard to manipulate role assignments, implying local privilege escalation. If an attacker gains elevated privileges they can fully control the site, compromise data, and establish persistence.