# CVE-2026-25434: WP2LEADS SQL injection requiring subscriber access

Source: https://junglewise.ai/threats/cve-2026-25434-subscriber-sql-injection-in-wp2leads-3-5-7-versions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-25434 · Severity: high · CVSS 8.5 · Published 2026-10-06

WP2LEADS is a WordPress plugin that captures and manages leads from websites. A SQL injection vulnerability in versions 3.5.7 and earlier allows authenticated subscribers to read, modify, or delete the entire website database, including user credentials and private customer data. An attacker with a subscriber account can perform these actions without administrative privileges.

Technologies: [Tobias WP2LEADS](https://junglewise.ai/threats/technologies/wp2leads). Vendors: [Tobias](https://junglewise.ai/threats/vendors/tobias).

## Quick answers

**Is CVE-2026-25434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25434 being exploited in the wild.

**How severe is CVE-2026-25434?** High severity, with a CVSS score of 8.5, published 6 October 2026.

**Which products and versions are affected?** Tobias WP2LEADS <= 3.5.7.

**Is there a fix for CVE-2026-25434?** No fixed version is recorded yet. Apply a Web Application Firewall (WAF) mitigation rule from Patchstack to block SQL injection attempts until an official patch becomes available. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-25434 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-25434?** Check whether you run Tobias WP2LEADS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Apply a Web Application Firewall (WAF) mitigation rule from Patchstack to block SQL injection attempts until an official patch becomes available.

## Technical details

The plugin contains a SQL injection flaw exploitable by users with subscriber-level privileges. The vulnerability allows attackers to execute arbitrary SQL queries against the WordPress database, gaining full read and write access to sensitive data. No official patch is currently available; vendors have issued WAF-based mitigation rules to block exploitation attempts.

## Affected products

- Tobias WP2LEADS <= 3.5.7

## Timeline

- 2026-10-05: disclosed
- 2026-10-06: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-5-7-sql-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp2leads/vulnerability/wordpress-wp2leads-plugin-3-5-7-sql-injection-vulnerability?_s_id=cve)

## Related threats

- [Tobias WP2LEADS privilege escalation in access control](https://junglewise.ai/threats/cve-2026-120834-incorrect-privilege-assignment-vulnerability-in-tobias-wp2leads)
- [WP2LEADS broken access control in subscriber role](https://junglewise.ai/threats/cve-2026-25433-subscriber-broken-access-control-in-wp2leads-3-5-7-versions)