CVE-2026-4375: WordPress Plugins RCE Vulnerability

CVE-2026-4375 Overview

CVE-2026-4375 affects the DoLeads Integrator WordPress plugin through version 0.65 and the wp2epub WordPress plugin through version 0.65. Attackers can leverage these plugins to achieve remote code execution (RCE) once they are added to a WordPress blog. The plugins are described as unclosed extensions from wordpress.org that unauthorized users can install through a separate installation vulnerability. This chain converts an installation weakness into full server-side code execution on the underlying WordPress host.

Critical Impact
Successful exploitation results in remote code execution on the affected WordPress server, exposing site content, credentials, and potentially the underlying host to full compromise.

Affected Products

DoLeads Integrator WordPress plugin through 0.65
wp2epub WordPress plugin through 0.65
WordPress sites permitting installation of these unclosed wordpress.org extensions

Discovery Timeline

2026-07-07 - CVE-2026-4375 published to the National Vulnerability Database (NVD)
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-4375

Vulnerability Analysis

CVE-2026-4375 is a Remote Code Execution (RCE) issue impacting two abandoned WordPress plugins: DoLeads Integrator and wp2epub, both through version 0.65. According to the WPScan Vulnerability Advisory, the plugins have been observed as the payload delivery mechanism after an attacker installs them onto a target blog. The plugins are labeled as unclosed extensions on wordpress.org, meaning they remain reachable through the plugin directory despite being unmaintained. When paired with a separate installation vulnerability that lets unauthorized users install plugins, the attacker gains code execution on the WordPress host.

Root Cause

The root cause is a combination of two conditions. First, DoLeads Integrator and wp2epub contain plugin functionality that enables arbitrary code execution once loaded by WordPress. Second, these packages remain distributable through wordpress.org as unclosed extensions, so a prior installation flaw can pull them into a target site without administrator consent. Together these conditions produce an installable RCE payload.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction on the target site. An attacker abuses an upstream installation weakness to add DoLeads Integrator or wp2epub to a WordPress instance. Once the plugin is present and activated, the attacker triggers the plugin's execution path to run arbitrary commands within the WordPress PHP process. The scope changes because the compromised plugin can affect resources beyond WordPress itself, including the web server user context.

No verified public exploit code is available. Refer to the WPScan Vulnerability Advisory for technical detail on the abuse chain.

Detection Methods for CVE-2026-4375

Indicators of Compromise

Presence of the doleads-integrator or wp2epub directories under wp-content/plugins/ on WordPress installations
Unexpected plugin activation events in the WordPress wp_options table or audit logs referencing these plugin slugs
Outbound HTTP requests from the web server to unrecognized command-and-control hosts following plugin activation
New or modified PHP files under wp-content/ with recent timestamps that do not correspond to legitimate updates

Detection Strategies

Inventory installed plugins across all WordPress sites and flag any instance of DoLeads Integrator or wp2epub at version 0.65 or earlier
Monitor WordPress admin actions for plugin installation and activation events initiated by non-administrator or anonymous sessions
Alert on PHP process activity that spawns shell interpreters such as sh, bash, or cmd.exe from the web server user

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/ directory to detect unauthorized plugin drops
Forward WordPress access logs and PHP-FPM logs to a centralized SIEM for correlation of installation and execution events
Track plugin metadata against the wordpress.org plugin directory to identify closed or unclosed extensions in use

How to Mitigate CVE-2026-4375

Immediate Actions Required

Remove the DoLeads Integrator and wp2epub plugins from any WordPress site where they are installed
Audit WordPress user accounts and rotate credentials for administrator and database users if either plugin was present
Identify and patch the upstream installation vulnerability that allows unauthorized users to install plugins from wordpress.org
Review web server, PHP, and WordPress logs for signs of prior exploitation and code execution

Patch Information

No vendor patch is referenced for CVE-2026-4375. Both DoLeads Integrator and wp2epub are described as unclosed extensions through version 0.65, indicating the projects are not actively maintained. Site owners should uninstall the affected plugins rather than expect a fix. See the WPScan Vulnerability Advisory for the current status.

Workarounds

Restrict plugin installation to authenticated administrators and disable installation from remote sources where possible
Set DISALLOW_FILE_MODS to true in wp-config.php to block plugin and theme installation through the WordPress UI
Deploy a web application firewall rule that blocks plugin upload and installation endpoints for unauthenticated requests
Maintain an allowlist of approved plugins and reject installations that do not match the allowlist

bash

# Configuration example: disable plugin/theme installation in wp-config.php
define( 'DISALLOW_FILE_MODS', true );

# Remove the vulnerable plugins from the filesystem
rm -rf /var/www/html/wp-content/plugins/doleads-integrator
rm -rf /var/www/html/wp-content/plugins/wp2epub

# Verify no residual files remain
find /var/www/html/wp-content/plugins/ -maxdepth 1 -type d \
  \( -name 'doleads-integrator' -o -name 'wp2epub' \)