CVE-2026-1255: YS LeadGen WordPress Information Disclosure

CVE-2026-1255 Overview

CVE-2026-1255 is a sensitive information exposure vulnerability in the YS LeadGen plugin for WordPress. The flaw affects all versions up to and including 2.1.4. The ysleadgen_get_captured_data AJAX action lacks authentication and capability checks, allowing unauthenticated network attackers to retrieve captured form submission data. Exposed data includes personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms. The vulnerability is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated attackers can exfiltrate stored lead-capture data, exposing PII collected through YS LeadGen forms and creating downstream privacy, phishing, and regulatory risk.

Affected Products

YS LeadGen plugin for WordPress (all versions through 2.1.4)
WordPress sites with YS LeadGen installed and lead capture enabled
Any site retaining historical form submissions in the plugin's data store

Discovery Timeline

2026-09-19 - CVE-2026-1255 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-1255

Vulnerability Analysis

The YS LeadGen plugin registers an AJAX endpoint named ysleadgen_get_captured_data intended to return form submissions collected by the plugin. The handler is registered against both the authenticated wp_ajax_ hook and the unauthenticated wp_ajax_nopriv_ hook without validating the requester's identity or capabilities. Any remote client that can reach /wp-admin/admin-ajax.php can invoke the action and receive the stored submission records in the response.

Because the plugin is designed to capture lead information, the exposed dataset typically contains contact names, email addresses, and free-text message fields. Attackers can automate collection across many sites running the plugin, aggregating PII for phishing, credential stuffing preparation, or resale. The issue affects confidentiality only; the integrity of stored data and site availability are not directly impacted.

Root Cause

The root cause is a missing authorization control on a sensitive AJAX action. The ysleadgen_get_captured_data handler does not call current_user_can(), does not verify a valid nonce, and is exposed through the nopriv variant of the WordPress AJAX API. This combination allows any anonymous HTTP client to trigger the data retrieval path.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an HTTP POST or GET request to admin-ajax.php with the action parameter set to ysleadgen_get_captured_data. The server returns the captured submission records in the response body. No user interaction, credentials, or prior foothold are required. Refer to the WordPress Plugin Ajax Controller source and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2026-1255

Indicators of Compromise

HTTP requests to /wp-admin/admin-ajax.php containing the parameter action=ysleadgen_get_captured_data originating from unauthenticated sessions.
Unusually large response payloads from admin-ajax.php correlated with the YS LeadGen action name.
Repeated or scripted access patterns to the AJAX endpoint from a single IP or ASN, particularly from cloud or hosting ranges.

Detection Strategies

Search web server and WordPress access logs for the string ysleadgen_get_captured_data and flag any occurrence without an authenticated session cookie.
Deploy a web application firewall (WAF) rule that blocks unauthenticated requests to this specific AJAX action.
Correlate outbound data volume from the site with requests to the vulnerable endpoint to identify bulk exfiltration.

Monitoring Recommendations

Alert on any successful HTTP 200 response to the ysleadgen_get_captured_data action from anonymous clients.
Monitor for scanner user agents and repeated enumeration against WordPress plugin AJAX endpoints.
Review DLP or egress telemetry for CSV, JSON, or bulk email-address exports leaving the web tier.

How to Mitigate CVE-2026-1255

Immediate Actions Required

Update the YS LeadGen plugin to a patched version above 2.1.4 as soon as it is available in the WordPress plugin repository.
If a patched release is not yet installable, deactivate and remove the plugin until it can be upgraded.
Assess whether captured lead data has been accessed and prepare breach notification procedures where PII exposure is confirmed under applicable regulations.

Patch Information

The vendor addressed the issue in WordPress Changeset #3577391. Administrators should apply the fixed release through the WordPress plugins dashboard or via wp-cli. Confirm the installed version reports higher than 2.1.4 after the update.

Workarounds

Block requests to /wp-admin/admin-ajax.php where the action parameter equals ysleadgen_get_captured_data at the WAF or reverse proxy.
Restrict access to admin-ajax.php for unauthenticated users using IP allowlisting where operationally feasible.
Purge or export and archive existing captured submission records to reduce the volume of data exposed by any successful exploitation attempt.

bash

# Example NGINX rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "ysleadgen_get_captured_data") {
        return 403;
    }
    if ($request_body ~* "action=ysleadgen_get_captured_data") {
        return 403;
    }
}