by Kastro
Paper/Archive/CVE-2026-4375

CVE-2026-4375

Unknown DoLeads Integrator — DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE

EPSS 0.4%CVSS 9.0
critical.is priorityof 100
34
CVSS 9.0 (ADP)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 36.4.364 × 207.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users.

Affected

ProductAffectedFixed inSource
DoLeads Integrator≤ 0.65–CNA
wp2epub≤ 0.65–CNA

Scores by source

CISA ADP9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

exploitwpscan.com/vulnerability/dd043e6c-e6c6-4c8d-aab0-5265d28f5cf6