CVE-2026-1890: LeadConnector WordPress Auth Bypass Flaw

CVE-2026-1890 Overview

CVE-2026-1890 is a missing authorization vulnerability in the LeadConnector WordPress plugin versions before 3.0.22. The plugin exposes a REST API route without proper authorization checks. Unauthenticated remote attackers can call this route and overwrite existing data stored by the plugin. The flaw maps to a broken access control weakness in a public REST endpoint.

Critical Impact
Unauthenticated attackers can send network requests to an exposed REST route and overwrite existing plugin data on affected WordPress sites.

Affected Products

LeadConnector WordPress plugin versions prior to 3.0.22
WordPress sites with the LeadConnector plugin enabled
Any deployment exposing the WordPress REST API to untrusted networks

Discovery Timeline

2026-03-26 - CVE-2026-1890 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1890

Vulnerability Analysis

The LeadConnector plugin registers a REST API route through the WordPress REST infrastructure. The route definition omits a permission_callback that enforces authentication or capability checks. As a result, the WordPress REST controller dispatches incoming requests without validating the caller. Any client that can reach the site over HTTP can invoke the endpoint.

The handler accepts request parameters and writes them into existing plugin storage. Because no authorization gate runs before the write, the request modifies persistent data on behalf of an anonymous user. The integrity impact is limited to data managed by the plugin, which is consistent with the partial integrity rating in the CVSS vector.

Root Cause

The root cause is missing authorization on a REST route registered by the plugin. In WordPress, REST routes registered with register_rest_route() require an explicit permission_callback to gate access. When this callback is absent or returns true unconditionally, the route becomes publicly callable. LeadConnector versions before 3.0.22 ship with this misconfiguration on a route that performs state-changing writes.

Attack Vector

The attack vector is network based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the vulnerable REST endpoint exposed under /wp-json/. The request body contains the data the attacker wishes to write. The plugin processes the request and overwrites existing records without verifying the caller. Refer to the WPScan Vulnerability Advisory for endpoint specifics.

Detection Methods for CVE-2026-1890

Indicators of Compromise

Unexpected modification timestamps on LeadConnector configuration records or stored leads
HTTP requests to LeadConnector REST routes under /wp-json/ originating from unauthenticated sources
Plugin data fields containing unexpected values, test strings, or attacker-controlled markers

Detection Strategies

Review web server access logs for POST, PUT, or PATCH requests to /wp-json/ paths associated with LeadConnector
Correlate REST API write activity with the absence of an authenticated WordPress session cookie
Inspect the WordPress database for changes to plugin tables made outside administrative sessions

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform for retention and search
Alert on bursts of requests targeting plugin REST namespaces from a single source IP
Track plugin version inventory across WordPress fleets and flag installations below version 3.0.22

How to Mitigate CVE-2026-1890

Immediate Actions Required

Update the LeadConnector plugin to version 3.0.22 or later on every affected WordPress site
Audit plugin-managed data for unauthorized modifications since the plugin was first deployed
Restrict access to the WordPress REST API from untrusted networks where business requirements allow

Patch Information

The vendor addressed CVE-2026-1890 in LeadConnector version 3.0.22. The fix adds authorization enforcement to the affected REST route. Administrators should apply the update through the WordPress plugin manager or by deploying the patched package. See the WPScan Vulnerability Advisory for advisory details.

Workarounds

Deactivate the LeadConnector plugin until the update to 3.0.22 can be applied
Block external requests to the affected REST namespace at a web application firewall or reverse proxy
Limit REST API access using an authentication plugin that enforces a permission_callback requirement

bash

# Configuration example: block unauthenticated access to the plugin REST namespace at the web server
location ~ ^/wp-json/leadconnector/ {
    if ($http_authorization = "") {
        return 403;
    }
}