Live › vulnerability › CVE-2026-90888
LeadSnap, a plugin for WordPress sites, deserializes attacker-supplied PHP objects without authentication. A remote visitor may be able to trigger object injection, which can lead to code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the LeadSnap plugin at version 1.25 or earlier are described as affected. The sources do not say whether the flaw needs a particular setting or feature to be enabled. Sites without LeadSnap installed are not affected.
No product ranges from the sources yet.
1.25; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-90888")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.