OpenCVE

The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://wpscan.com/vulnerability/dd043e6c-e6c6-4c8d-aab0-5265d28f5cf6/

History

Tue, 14 Jul 2026 07:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284 CWE-78

Mon, 13 Jul 2026 10:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-284 CWE-78

Fri, 10 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284 CWE-78

Fri, 10 Jul 2026 06:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-78

Thu, 09 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-78

Wed, 08 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-94

Tue, 07 Jul 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-94

Tue, 07 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 07 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users.
Title		DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE
References		https://wpscan.com/vulnerability/dd043e6c-e6c6-4c8d-aab0-5265d28f5cf6/

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-07-07T06:00:01.899Z

Updated: 2026-07-07T13:18:43.079Z

Reserved: 2026-03-18T12:16:21.066Z

Link: CVE-2026-4375

Vulnrichment

Updated: 2026-07-07T13:17:10.248Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4375", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-03-18T12:16:21.066Z", "datePublished": "2026-07-07T06:00:01.899Z", "dateUpdated": "2026-07-07T13:18:43.079Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-07-07T06:00:01.899Z"}, "title": "DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE", "problemTypes": [{"descriptions": [{"description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "DoLeads Integrator", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "0.65"}], "defaultStatus": "unknown"}, {"vendor": "Unknown", "product": "wp2epub", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "0.65"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users."}], "references": [{"url": "https://wpscan.com/vulnerability/dd043e6c-e6c6-4c8d-aab0-5265d28f5cf6/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Erwan LR (WPScan)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-07T13:17:36.198319Z", "id": "CVE-2026-4375", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T13:18:43.079Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4375", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-03-18T12:16:21.066Z", "datePublished": "2026-07-07T06:00:01.899Z", "dateUpdated": "2026-07-07T13:18:43.079Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-07-07T06:00:01.899Z"}, "title": "DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE", "problemTypes": [{"descriptions": [{"description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "DoLeads Integrator", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "0.65"}], "defaultStatus": "unknown"}, {"vendor": "Unknown", "product": "wp2epub", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThanOrEqual": "0.65"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "The DoLeads Integrator WordPress plugin through 0.65, wp2epub WordPress plugin through 0.65 have been seen to be used to achieve RCE, once they are added adding to a blog, for example using a vulnerability where unclosed extensions from wordpress.org can be installed by unauthorized users."}], "references": [{"url": "https://wpscan.com/vulnerability/dd043e6c-e6c6-4c8d-aab0-5265d28f5cf6/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Erwan LR (WPScan)", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-4375", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-07T13:17:36.198319Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-07T13:17:10.248Z"}}]}}