CVE-2026-10835 Overview
CVE-2026-10835 is a SQL injection vulnerability in the SALESmanago & Leadoo WordPress plugin versions prior to 3.11.3. The plugin fails to sanitize and escape a parameter passed to one of its AJAX actions before including it in a SQL statement. The affected AJAX action also lacks proper authorization checks. Authenticated users with minimal permissions, including the subscriber role, can exploit this flaw to inject arbitrary SQL queries against the WordPress database. Successful exploitation exposes confidential data stored in the database, including user credentials and site configuration.
Critical Impact
Any authenticated subscriber account can extract sensitive database contents through crafted AJAX requests against unpatched installations.
Affected Products
- SALESmanago & Leadoo WordPress plugin versions before 3.11.3
- WordPress sites with the plugin installed and user registration enabled
- WordPress environments allowing subscriber-level or higher accounts
Discovery Timeline
- 2026-06-26 - CVE-2026-10835 published to the National Vulnerability Database (NVD)
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-10835
Vulnerability Analysis
The vulnerability is a SQL injection [CWE-89] combined with a broken access control [CWE-862] flaw. The plugin registers an AJAX action handler that accepts a user-supplied parameter and concatenates it directly into a SQL query. Because the handler is registered for authenticated users without a capability check or nonce verification enforcing role restrictions, any logged-in user, including those with the lowest privilege subscriber role, can invoke the endpoint.
WordPress installations that allow open user registration are the most exposed. An attacker only needs to register a free account, then send a crafted request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the vulnerable action name and a malicious parameter value.
Root Cause
The root cause is twofold. First, the plugin does not apply esc_sql() or use prepared statements via $wpdb->prepare() before passing input into the SQL query. Second, the AJAX action handler omits a current_user_can() capability check that would restrict execution to privileged roles. The combined absence of input sanitization and authorization enforcement creates an exploitable primitive.
Attack Vector
The attack is remote and requires only low-privilege authentication. An attacker authenticates to the target WordPress site, obtains a valid session cookie, and issues an HTTP POST request to admin-ajax.php specifying the vulnerable action and a SQL injection payload in the affected parameter. Because the scope changes to the database, the injection can enumerate tables, extract wp_users password hashes, and read secret keys stored in wp_options. No user interaction is required beyond the attacker's own session.
See the WPScan Vulnerability Report for further technical details.
Detection Methods for CVE-2026-10835
Indicators of Compromise
- Unusual POST requests to /wp-admin/admin-ajax.php originating from subscriber-level accounts
- AJAX request bodies containing SQL syntax such as UNION SELECT, SLEEP(, information_schema, or -- comment sequences
- Newly registered subscriber accounts followed by immediate AJAX traffic to the plugin's action handler
- Spikes in database query latency correlating with admin-ajax.php requests
Detection Strategies
- Inspect web server access logs for admin-ajax.php requests carrying the plugin's action parameter combined with SQL metacharacters.
- Enable and review MySQL general query or slow query logs for time-based injection patterns such as BENCHMARK() or SLEEP() calls.
- Deploy a Web Application Firewall (WAF) rule set that inspects POST bodies for SQL injection signatures targeting the plugin's action name.
Monitoring Recommendations
- Alert on any low-privilege WordPress account issuing more than a small threshold of admin-ajax.php requests within a short window.
- Monitor for the creation of new subscriber accounts followed by database read patterns inconsistent with normal browsing.
- Correlate WordPress authentication events with outbound data volume to identify staged exfiltration.
How to Mitigate CVE-2026-10835
Immediate Actions Required
- Update the SALESmanago & Leadoo plugin to version 3.11.3 or later on every affected WordPress site.
- Audit existing user accounts and remove unrecognized subscriber-level registrations created before the patch.
- Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API tokens stored in wp_options.
- Review database logs for evidence of data exfiltration during the exposure window.
Patch Information
The vendor released version 3.11.3 of the SALESmanago & Leadoo plugin, which adds parameter sanitization and enforces capability checks on the affected AJAX action. Administrators should apply the update through the WordPress plugin dashboard or by replacing the plugin files manually. Refer to the WPScan Vulnerability Report for the vendor's remediation reference.
Workarounds
- Deactivate the SALESmanago & Leadoo plugin until it can be updated to version 3.11.3.
- Disable open user registration by unchecking Anyone can register under Settings → General to eliminate the authenticated attacker prerequisite.
- Restrict access to /wp-admin/admin-ajax.php at the WAF layer for the specific vulnerable action name.
# Disable open registration via WP-CLI as a temporary control
wp option update users_can_register 0
# List plugin versions to confirm the patched build is installed
wp plugin get salesmanago-leadoo --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
