# WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden <= 3.5.6 - Authenticated (Subscriber+) Missing Authorization to Multiple AJAX Actions

- **ID:** WPSEC-2026-1717
- **Plugin:** WP2LEADS |  WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden (`wp2leads`), https://wordpress.org/plugins/wp2leads/
- **Affected versions:** all versions before 3.5.12
- **Fixed in:** 3.5.12 (Update to 3.5.12 or later.)
- **Severity:** High 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp2leads
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1717/

## Description

The WP2LEADS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on numerous AJAX handlers (such as wp2l_global_table_search_results, wp2l_single_multisearch_table, wp2l_fetch_map_query_results, wp2l_settings_klick_tip_credentials, wp2l_set_transient, wp2l_maps_actions_run and wp2l_detach_from_tag) in all versions up to, and including, 3.5.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary database tables (including user records), read and modify maps, read, set and delete arbitrary transients, trigger or terminate data transfers to KlickTipp, change the KlickTipp credentials, detach contacts from tags, and invoke CRM plugin installation logic.

## References

- https://wpsec.com/vuln/WPSEC-2026-1717/
- https://plugins.svn.wordpress.org/wp2leads/tags/3.5.12/
- https://wordpress.org/plugins/wp2leads/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1717/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.