CVE-2026-90888

Name of the Vulnerable Software and Affected Versions LeadSnap versions 1.25 and earlier

Description An unauthenticated attacker can perform a PHP Object Injection by sending crafted input to the lead plugin. This occurs when the application unserializes untrusted data, which can lead to the alteration of site data. PHP Object Injection is a vulnerability where an attacker can manipulate serialized objects to execute arbitrary code or modify application logic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.