The WP2LEADS plugin versions up to 3.5.7 contain a missing authorization check that allows users without proper roles to access subscriber‑level pages. This flaw enables an attacker to view or change lead data, alter settings, and potentially perform administrative actions that should be restricted. The weakness is classified as CWE‑862.

Any WordPress site that has the WP2LEADS plugin from Tobias @Saleswonder.biz installed at version 3.5.7 or older is affected by the broken access control flaw. The issue is present in all releases of the plugin that fall below that version threshold.

The CVSS score of 7.1 indicates moderate to high severity, and the vulnerability is not listed in the CISA KEV catalog. An EPSS score of less than 1% suggests a very low probability of exploitation, which still leaves the potential impact significant if the flaw is compromised. Based on the description, it is inferred that the attack vector is the web interface of the plugin; an attacker only needs to reach the plugin’s endpoints, potentially from a low‑privilege or anonymous account, to exploit the flaw.