CVE

CVE-2026-1890

5.3

CVSSmedium

Exploitable remotely over the internet · no authentication required.

Description

The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data

Attack Vector

Network

Privileges Req.

None

User Interaction

None

leadconnector

Updated Nov 10, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write

LeadConnector WordPress plugin References: https://wpscan.com/vulnerability/9b88be70-b5cc-4a3f-a871-64d61cb02076/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1890 Remediation: Update to version 3.0.22 or later.

Used 20 times · 10 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: leadconnector

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →