CVE-2025-9462

Name of the Vulnerable Software and Affected Versions WP2LEADS versions prior to 3.5.7

Description Authenticated attackers with Subscriber-level access and above can perform a time-based SQL Injection. This occurs because the plugin fails to sufficiently escape the order parameter and lacks proper preparation of the SQL query, allowing the injection of additional queries to extract sensitive information from the database.

Recommendations Update the plugin to a version newer than 3.5.6. As a temporary mitigation, restrict access to the order parameter for users with Subscriber-level permissions.