# WP2LEADS <= 3.5.16 - Unauthenticated Authentication Bypass via 'kt_invite' Parameter

- **ID:** WPSEC-2026-2439
- **Plugin:** WP2LEADS |  WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden (`wp2leads`), https://wordpress.org/plugins/wp2leads/
- **Affected versions:** all versions before 3.5.17
- **Fixed in:** 3.5.17 (Update to 3.5.17 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp2leads
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2439/

## Description

The WP2LEADS plugin for WordPress is vulnerable to Authentication Bypass via the 'kt_invite' invite login link in all versions up to, and including, 3.5.16. This is due to the autologin_kt_invite() function, which runs on init, treating the KlickTipp subscriber ID in the link as the only proof of identity. It looks up the WordPress user by that ID or by the contact's e-mail address, creates the user if none exists, and sets an auth cookie for that user. This makes it possible for unauthenticated attackers who know or guess a KlickTipp subscriber ID to log in as any WordPress user whose e-mail address is in the site's connected KlickTipp contact list, including administrators. Subscriber IDs are numeric and can be enumerated.

## References

- https://wpsec.com/vuln/WPSEC-2026-2439/
- https://plugins.svn.wordpress.org/wp2leads/tags/3.5.17/
- https://wordpress.org/plugins/wp2leads/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2439/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.