{"id":"CVE-2026-120834","kind":"vulnerability","aliases":["CVE-2026-120834"],"related":[],"title":"WP2LEADS WordPress plugin: incorrect privilege assignment lets users escalate privileges","description":"Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects WP2LEADS: from n/a through 3.5.17.","summary":"WP2LEADS by Tobias is a WordPress plugin with an incorrect privilege assignment flaw. Per the NVD entry, an attacker can escalate privileges on affected versions up to and including 3.5.17.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wp2leads","fixed":["3.5.18"],"affected":"<= 3.5.17","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","wordpress","wp2leads"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP2LEADS plugin version in the WordPress admin plugins page or `wp plugin get wp2leads --field=version`\n- Compare the installed version against 3.5.17; versions up to and including `3.5.17` are listed as affected\n- Review user accounts for unexpected role changes to administrator or editor","fix":"Update WP2LEADS to 3.5.18, the current release on WordPress.org (released 2026-11-02). The plugin page and Patchstack list a privilege escalation affecting up to 3.5.17 as patched, but neither names the fix version or ties it to this CVE, so 3.5.18 is the likely fix, not confirmed.","status":"open","published_at":"2026-11-09T19:16:44+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","triaged_at":"2026-11-09T19:30:14+00:00","updated_at":"2026-11-09T19:36:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T19:30:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP2LEADS WordPress plugin: incorrect privilege assignment lets users escalate privileges","impact":"high","summary":"WP2LEADS by Tobias is a WordPress plugin with an incorrect privilege assignment flaw. Per the NVD entry, an attacker can escalate privileges on affected versions up to and including 3.5.17.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp2leads"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gains elevated privileges on the WordPress site","analyst_note":"Confirm the fixed version, required privilege level and exploit details at https://nvd.nist.gov/vuln/detail/CVE-2026-120834 and the WordPress plugin repository.","how_to_check":"- Check the installed WP2LEADS plugin version in the WordPress admin plugins page or `wp plugin get wp2leads --field=version`\n- Compare the installed version against 3.5.17; versions up to and including `3.5.17` are listed as affected\n- Review user accounts for unexpected role changes to administrator or editor","plain_action":"","product_name":"wp2leads","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP2LEADS WordPress plugin at version 3.5.17 or earlier are listed as affected by the NVD entry. The sources do not describe the exact configuration or which roles can be escalated, so the scope beyond the version range is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00076,"input_tokens":4536,"output_tokens":613,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version, required privilege level and exploit details at https://nvd.nist.gov/vuln/detail/CVE-2026-120834 and the WordPress plugin repository.","search":"'-120834':13A,16A '-2026':12A,15A '3.5.17':50B,68C 'affect':44B,63C 'allow':59C 'assign':6A,32B,53C 'attack':39B 'cve':11A,14A 'entri':37B 'escal':9A,41B 'escalation.this':61C 'flaw':33B 'includ':49B 'incorrect':4A,30B,51C 'issu':62C 'let':7A 'n/a':66C 'nvd':36B 'packag':18B 'per':34B 'plugin':3A,27B 'privileg':5A,10A,31B,42B,52C,60C 'tobia':23B,56C 'user':8A 'version':45B 'vulner':54C 'wordpress':2A,19B,26B 'wp2leads':1A,17A,20B,21B,57C,58C,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP2LEADS WordPress plugin at version 3.5.17 or earlier are listed as affected by the NVD entry. The sources do not describe the exact configuration or which roles can be escalated, so the scope beyond the version range is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wp2leads"],"ptokens":["wp2leads"],"labels":["high","package","vendor","wordpress","wp2leads"],"campaign_type":null,"search_a":"'-120834':13A,16A '-2026':12A,15A 'assign':6A 'cve':11A,14A 'escal':9A 'incorrect':4A 'let':7A 'plugin':3A 'privileg':5A,10A 'user':8A 'wordpress':2A 'wp2leads':1A,17A","search_b":"'3.5.17':50B 'affect':44B 'assign':32B 'attack':39B 'entri':37B 'escal':41B 'flaw':33B 'includ':49B 'incorrect':30B 'nvd':36B 'packag':18B 'per':34B 'plugin':27B 'privileg':31B,42B 'tobia':23B 'version':45B 'wordpress':19B,26B 'wp2leads':20B,21B","search_c":"'3.5.17':68C 'affect':63C 'allow':59C 'assign':53C 'escalation.this':61C 'incorrect':51C 'issu':62C 'n/a':66C 'privileg':52C,60C 'tobia':56C 'vulner':54C 'wp2leads':57C,58C,64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120834","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120834","severity":null,"published_at":"2026-11-09T19:16:44+00:00","modified_at":"2026-11-09T19:16:45+00:00","first_seen_at":"2026-11-09T19:28:14+00:00","fetched_at":"2026-11-09T19:28:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120834:2336","url":"https://wordpress.org/plugins/wp2leads/","severity":null,"published_at":"2026-11-09T19:36:07+00:00","modified_at":"2026-11-09T19:36:07+00:00","first_seen_at":"2026-11-09T19:36:07+00:00","fetched_at":"2026-11-09T19:36:07+00:00","note":"NVD page unreadable via fetch; description (via signal) says through 3.5.17. WordPress.org shows 3.5.18 current; Patchstack lists a privilege escalation up to 3.5.17 as patched but gives no CVE link, fixed version or required privilege. Nothing verified, no exploit or PoC found. CVSS vector says network, no privileges required (Patchstack). web-cli search and X not used (search credits exhausted per notes).","cites":["https://wordpress.org/plugins/wp2leads/","https://patchstack.com/database/wordpress/plugin/wp2leads"]}],"documents":[{"id":109495,"url":"https://wordpress.org/plugins/wp2leads/","title":"WP2LEADS plugin page (WordPress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":109496,"url":"https://patchstack.com/database/wordpress/plugin/wp2leads","title":"Patchstack: WP2LEADS vulnerability database","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}