The WP2LEADS plugin before version 3.5.8 contains a subscriber input that is not properly sanitized, allowing an attacker to inject arbitrary SQL commands. This flaw can potentially read, modify, or delete database records related to WordPress users and site content, leading to data loss or compromise of sensitive information. In some configurations, the injected SQL could enable further exploitation of backend services, increasing the risk of remote code execution.

This vulnerability affects installations of the Tobias @Saleswonder.biz WP2LEADS plugin running any release up to and including 3.5.7. Site owners who have not upgraded beyond this version should consider the plugin as a potential entry point for attackers.

The vulnerability carries a CVSS score of 8.5, indicating high severity. EPSS score < 1% and the flaw is not listed in the CISA KEV catalog, suggesting limited public exploitation data. Attackers would typically target the plugin’s subscriber handling interface, which is exposed to unauthenticated users, making remote exploitation plausible if input validation is bypassed. The lack of a publicly known exploit does not negate the risk, as the flaw is straightforward to exploit with standard SQL injection techniques.