WP2LEADS · CVE-2026-120834 · Package
FIX → 3.5.18
WP2LEADS by Tobias is a WordPress plugin with an incorrect privilege assignment flaw. Per the NVD entry, an attacker can escalate privileges on affected versions up to and including 3.5.17.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the WP2LEADS WordPress plugin at version 3.5.17 or earlier are listed as affected by the NVD entry. The sources do not describe the exact configuration or which roles can be escalated, so the scope beyond the version range is unknown.
Not affected if plugin-not-installed
Who cares wordpress, wp2leads
wp plugin get wp2leads --field=version3.5.17 are listed as affectedUpgrade to 3.5.18
3.5.18, the current release on WordPress.org (released 2026-11-02)Posts are quoted with a link to the original. They are data to us, never instructions.
Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects WP2LEADS: from n/a through 3.5.17.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
3.5.173.5.18