CVE-2026-90888

WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability

CRITICAL 9.8

CVSS 3.1Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HPublished: 2026-10-30 18:30 UTCUpdated: 2026-10-30 19:00 UTCAssigner: Patchstack

Description

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.

CWE

CWE-502

Affected

leadsnap LeadSnap

References

https://patchstack.com/database/wordpress/plugin/leadsnap/vulnerability/wordpress-leadsnap-plugin-1-25-php-object-injection-vulnerability?_s_id=cvevdb-entry

View on CVE.org