CVE-2026-1890: 
WordPress vulnerability analysis and mitigation

CVE-2026-1890 is a Missing Authorization vulnerability in the LeadConnector WordPress plugin that allows unauthenticated users to call an unprotected REST API route and overwrite existing data in the database. It affects all versions of the LeadConnector plugin before 3.0.22. The vulnerability was publicly disclosed on March 5, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (WPScan, Feedly).

The root cause is a missing authorization check (CWE-862) on the REST API route /wp-json/lc_internal_api/v1/save_custom_values, which is exposed without any authentication or capability verification. An unauthenticated attacker can send a crafted HTTP POST request with arbitrary JSON payloads to this endpoint, causing the plugin to write attacker-controlled data directly into the wp_lc_custom_values database table. No user interaction, authentication, or elevated privileges are required for exploitation (WPScan).

Successful exploitation allows any unauthenticated remote attacker to overwrite or inject arbitrary data into the WordPress database table used by the LeadConnector plugin (wp_lc_custom_values). This primarily affects data integrity, as attackers can corrupt or manipulate CRM-related custom field values stored by the plugin. There is no direct confidentiality or availability impact based on the known attack vector, but data manipulation could disrupt business workflows or lead to downstream trust issues in CRM data (WPScan, Feedly).

A public proof-of-concept (PoC) is available via WPScan demonstrating exploitation with a simple curl command requiring no credentials. The EPSS score is approximately 0.022% (0.000220), indicating low but non-zero probability of exploitation in the wild. No evidence of active in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been identified at this time (WPScan, Feedly).

1. Reconnaissance: Identify WordPress sites running the LeadConnector plugin (versions < 3.0.22) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at /wp-content/plugins/leadconnector/readme.txt.
2. Confirm vulnerable endpoint: Verify the REST route is accessible by sending a GET or OPTIONS request to http://TARGET/wp-json/lc_internal_api/v1/save_custom_values.
3. Craft malicious payload: Prepare a JSON body with arbitrary fieldKey and id values to inject into the database, e.g., {"custom_values": [{"fieldKey": "HACKED", "id": "1337"}]}.
4. Send unauthenticated POST request: Execute the following command without any authentication headers:

curl -X POST "http://TARGET/wp-json/lc_internal_api/v1/save_custom_values" \
  -H "Content-Type: application/json" \
  -d '{"custom_values": [{"fieldKey": "HACKED", "id": "1337"}]}'

5. Verify data overwrite: Confirm the injected data was written to the database by checking the wp_lc_custom_values table for the injected field_key value (WPScan).

• Network: Unexpected HTTP POST requests to /wp-json/lc_internal_api/v1/save_custom_values from unauthenticated or unknown IP addresses; high-frequency requests to this endpoint from a single source IP.
• Logs: WordPress access logs showing POST requests to the vulnerable REST route without authentication cookies or nonces; HTTP 200 responses to unauthenticated POST requests on this endpoint.
• Database: Unexpected or anomalous rows in the wp_lc_custom_values table with unusual field_key values (e.g., HACKED, random strings, or values inconsistent with normal CRM usage) (WPScan).

Update the LeadConnector WordPress plugin to version 3.0.22 or later, which introduces proper authorization checks on the affected REST route. No official configuration-based workaround has been published; upgrading is the only recommended remediation. Site administrators can also use a Web Application Firewall (WAF) rule to block unauthenticated POST requests to /wp-json/lc_internal_api/v1/save_custom_values as a temporary measure until patching is feasible (WPScan).

The vulnerability was discovered and reported by researcher Yiğit İbrahim Sağlam (ibrahimsql) and verified by WPScan. A brief technical post was published by Infinit Security covering the unauthenticated REST call issue (Infinit Security). No significant broader media coverage or vendor statements beyond the WPScan advisory have been identified.