CVE-2026-1890

Medium · 5.3

CVSS

5.3

EPSS

0.7%

Published

Mar 26, 2026

CISA due date

—

The record

The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing data

Affected packages

Ecosystem	Package	Introduced	Fixed