Executive brief
The SALESmanago & Leadoo plugin for WordPress, which integrates marketing automation and lead generation tools, contains a security flaw that allows users with low-level accounts (such as subscribers) to access sensitive database information. By sending specially crafted requests, an attacker can bypass security checks to extract private data, including user password hashes and site configuration keys. This could lead to a full site takeover or the theft of customer information.
Technical details
A SQL injection vulnerability exists in the SALESmanago & Leadoo WordPress plugin before version 3.11.3 due to improper sanitization of the 'dateFrom' field within a base64-encoded JSON 'data' parameter. This parameter is passed to the 'salesmanago_export_count_contacts' AJAX action and concatenated directly into a SQL statement. Furthermore, the plugin fails to properly enforce authorization or validate nonces for this action; while an authorization helper exists, it returns early for non-administrators without terminating execution, allowing the request to proceed. An authenticated attacker with Subscriber-level permissions can exploit this via time-based blind SQL injection to exfiltrate sensitive data such as password hashes and secret keys. The issue is resolved in version 3.11.3.
Affected products
- SALESmanago SALESmanago & Leadoo < 3.11.3
Timeline
- 2026-06-05: disclosed: Publicly published by WPScan
- 2026-06-26: advisory: NVD publication date
- 2026-06-26: patched: Fixed in version 3.11.3