CVE-2026-10835: SQL Injection in SALESmanago & Leadoo WordPress Plugin

Technical summary

CVE-2026-10835 is a SQL injection vulnerability in the SALESmanago & Leadoo WordPress plugin. An AJAX action endpoint accepts user input without adequate sanitization or escaping before incorporating it into SQL statements. Additionally, the endpoint lacks proper authorization checks, permitting any authenticated user—including those with subscriber role—to trigger the vulnerable code path. The vulnerability requires only local network access and valid WordPress credentials; no user interaction is required for exploitation.

Business impact

Organizations using this plugin risk unauthorized data exfiltration from their WordPress databases, including customer records, order history, user credentials, and internal metadata. Subscriber-level compromise is particularly concerning in multisite or community-driven WordPress installations where registration may be open. Although the vulnerability does not permit data modification or system destruction, the confidentiality breach can lead to regulatory exposure (GDPR, CCPA), reputational damage, and competitive intelligence loss.

Affected systems

SALESmanago & Leadoo WordPress plugin versions before 3.11.3. The vulnerability requires an active WordPress installation with the plugin enabled and at least one authenticated user account at subscriber level or higher. Sites with open registration or permissive role assignments face elevated risk.

Exploitability

The vulnerability is relatively straightforward to exploit once authenticated access is obtained. An attacker crafting a malicious AJAX request with SQL metacharacters in the unvalidated parameter can extract database contents through time-based or union-based SQL injection techniques. No elevated privileges, complex configuration, or user interaction is required. The CVSS score of 7.7 reflects the high confidentiality impact balanced against the prerequisite of valid authentication.

Remediation

Immediately update the SALESmanago & Leadoo plugin to version 3.11.3 or later. Before patching, organizations should audit subscriber-level user accounts, disable the plugin if not actively in use, or restrict AJAX endpoint access via Web Application Firewall rules. Following the patch, verify the update completed successfully and confirm the AJAX action no longer accepts unsanitized SQL input.

Patch guidance

Update via WordPress admin dashboard (Plugins > Installed Plugins > SALESmanago & Leadoo) to version 3.11.3 or newer. Verify in plugin details that the version has been updated. If automatic updates are disabled, manually download the patched version from the official WordPress plugin repository. Test functionality after patching to ensure compatibility with your site configuration.

Detection guidance

Monitor WordPress access logs for unusual AJAX requests to the vulnerable endpoint with SQL metacharacters (SELECT, UNION, OR 1=1, etc.) in parameters. Enable WordPress security logging via plugins like Wordfence or Sucuri to flag suspicious subscriber-level activity. Check database query logs for anomalous data access patterns. Audit recent user account creation, especially subscriber roles, to identify potential compromise vectors.

Why prioritize this

This vulnerability merits urgent patching because it enables unauthenticated SQL injection through low-privilege accounts, significantly lowering the attack barrier in shared hosting or multisite environments. The lack of authorization enforcement and the high-severity confidentiality impact (CVSS 7.7) make it attractive to both automated scanners and targeted attackers seeking customer data or business intelligence.

Risk score, explained

The CVSS 3.1 score of 7.7 (HIGH) reflects: (1) Network-based attack vector requiring no special network segmentation; (2) Low complexity, exploitable with standard SQL injection payloads; (3) Low privilege requirement (subscriber role suffices); (4) High confidentiality impact enabling database exfiltration; (5) Changed scope (affects resources beyond the plugin's immediate scope). Severity is tempered by the requirement for valid authentication and lack of integrity/availability impact.

Frequently asked questions