WP2LEADS <= 3.5.16 - Unauthenticated Authentication Bypass via 'kt_invite' Parameter
- ID
- WPSEC-2026-2439
- Plugin
- WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden (wp2leads)
- Affected
- all versions before 3.5.17
- Remediation
- Update to 3.5.17 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- WP2LEADS on WPSec AttackSurface
- Fix released
- Published
Description
The WP2LEADS plugin for WordPress is vulnerable to Authentication Bypass via the 'kt_invite' invite login link in all versions up to, and including, 3.5.16. This is due to the autologin_kt_invite() function, which runs on init, treating the KlickTipp subscriber ID in the link as the only proof of identity. It looks up the WordPress user by that ID or by the contact's e-mail address, creates the user if none exists, and sets an auth cookie for that user. This makes it possible for unauthenticated attackers who know or guess a KlickTipp subscriber ID to log in as any WordPress user whose e-mail address is in the site's connected KlickTipp contact list, including administrators. Subscriber IDs are numeric and can be enumerated.
References
- https://wpsec.com/vuln/WPSEC-2026-2439/
- https://plugins.svn.wordpress.org/wp2leads/tags/3.5.17/
- https://wordpress.org/plugins/wp2leads/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS