{
 "id": "WPSEC-2026-2439",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2439/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2439/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2439/index.md",
 "title": "WP2LEADS <= 3.5.16 - Unauthenticated Authentication Bypass via 'kt_invite' Parameter",
 "description": "The WP2LEADS plugin for WordPress is vulnerable to Authentication Bypass via the 'kt_invite' invite login link in all versions up to, and including, 3.5.16. This is due to the autologin_kt_invite() function, which runs on init, treating the KlickTipp subscriber ID in the link as the only proof of identity. It looks up the WordPress user by that ID or by the contact's e-mail address, creates the user if none exists, and sets an auth cookie for that user. This makes it possible for unauthenticated attackers who know or guess a KlickTipp subscriber ID to log in as any WordPress user whose e-mail address is in the site's connected KlickTipp contact list, including administrators. Subscriber IDs are numeric and can be enumerated.",
 "plugin": {
  "slug": "wp2leads",
  "name": "WP2LEADS",
  "full_name": "WP2LEADS |  WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden",
  "wordpress_org": "https://wordpress.org/plugins/wp2leads/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp2leads/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp2leads"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.5.17",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.5.17"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.5.17",
 "remediation": "Update to 3.5.17 or later.",
 "fix_released": "2026-11-02T21:55:21+00:00",
 "published": "2026-11-03T22:43:40+00:00",
 "updated": "2026-11-03T13:41:13.180495+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2439/",
  "https://plugins.svn.wordpress.org/wp2leads/tags/3.5.17/",
  "https://wordpress.org/plugins/wp2leads/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp2leads",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}