The LeadConnector WordPress plugin before version 3.0.22 lacks proper authorization on a REST API route, allowing any user with internet access to invoke the route and overwrite existing data. The vulnerability is an instance of improper authorization, which can lead to integrity violations and loss of legitimate business information. By replacing stored records, an attacker can corrupt lead data or sinkholes essential user information, potentially affecting the entire client base.

WordPress sites that have the LeadConnector plugin installed with a version lower than 3.0.22 are vulnerable. No specific vendor distribution beyond the plugin itself is identified, and the affected versions span all releases prior to 3.0.22.

The CVSS score of 5.3 indicates moderate severity. EPSS of less than 1% suggests a low probability of broad exploitation, and the catalog does not list it as a known exploited vulnerability. The attack vector is inferred to be remote and unauthenticated, triggered via a public REST endpoint in the WordPress installation, which the attacker can call without credentials.