---
id: "CVE-2026-120834"
page: "https://infrastack.ai/live/CVE-2026-120834"
kind: "vulnerability"
aliases: ["CVE-2026-120834"]
title: "WP2LEADS WordPress plugin: incorrect privilege assignment lets users escalate privileges"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wp2leads", "fixed": ["3.5.18"], "affected": "<= 3.5.17", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "wordpress", "wp2leads"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-09T19:16:44+00:00"
first_seen_at: "2026-11-09T19:28:14+00:00"
updated_at: "2026-11-09T19:36:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120834", "first_seen_at": "2026-11-09T19:28:14+00:00"}, {"source": "analyst", "url": "https://patchstack.com/database/wordpress/plugin/wp2leads", "first_seen_at": "2026-11-09T19:36:07+00:00", "cites": ["https://patchstack.com/database/wordpress/plugin/wp2leads", "https://wordpress.org/plugins/wp2leads/"]}]
exploit_sources: []
---

# WP2LEADS WordPress plugin: incorrect privilege assignment lets users escalate privileges

Link for people: https://infrastack.ai/live/CVE-2026-120834 (this .md is for agents)

WP2LEADS by Tobias is a WordPress plugin with an incorrect privilege assignment flaw. Per the NVD entry, an attacker can escalate privileges on affected versions up to and including 3.5.17.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:wp2leads affected <= 3.5.17 fixed 3.5.18

## How to check

- Check the installed WP2LEADS plugin version in the WordPress admin plugins page or `wp plugin get wp2leads --field=version`
- Compare the installed version against 3.5.17; versions up to and including `3.5.17` are listed as affected
- Review user accounts for unexpected role changes to administrator or editor

## Fix

Update WP2LEADS to 3.5.18, the current release on WordPress.org (released 2026-11-02). The plugin page and Patchstack list a privilege escalation affecting up to 3.5.17 as patched, but neither names the fix version or ties it to this CVE, so 3.5.18 is the likely fix, not confirmed.

## Timeline

- 2026-11-09T19:28:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120834
- 2026-11-09T19:36:07+00:00 analyst https://patchstack.com/database/wordpress/plugin/wp2leads — NVD page unreadable via fetch; description (via signal) says through 3.5.17. WordPress.org shows 3.5.18 current; Patchstack lists a privilege escalation up to 3.5.17 as patched but gives no CVE link, fixed version or required privilege. Nothing verified, no exploit or PoC found. CVSS vector says network, no privileges required (Patchstack). web-cli search and X not used (search credits exhausted per notes).

## Documents

- [describes] Patchstack: WP2LEADS vulnerability database https://patchstack.com/database/wordpress/plugin/wp2leads
- [fix] WP2LEADS plugin page (WordPress.org) https://wordpress.org/plugins/wp2leads/

## From the sources

Incorrect Privilege Assignment vulnerability in Tobias WP2LEADS wp2leads allows Privilege Escalation.This issue affects WP2LEADS: from n/a through 3.5.17.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_