CVE-2026-1255

Received Received - Intake

Sensitive Information Exposure in YS LeadGen WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-1255

Affected Vendors & Products

Vendor	Product	Version / Range
ysleadgen	leadgen_plugin	to 2.1.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The YS LeadGen WordPress plugin up to version 2.1.4 has a flaw where an unauthenticated user can access sensitive data through the 'ysleadgen_get_captured_data' AJAX action. This allows attackers to retrieve all form submissions, including personal details like names, emails, and messages.

Impact Analysis

If you use this plugin, attackers could steal all form submission data, exposing personal information. This could lead to privacy breaches, identity theft, or misuse of collected data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal data. GDPR requires protecting PII, and HIPAA mandates safeguarding health-related data. The exposure could result in legal penalties and loss of compliance certifications.

Mitigation Strategies

Immediately update the YS LeadGen plugin to the latest version beyond 2.1.4 to patch the vulnerability. If an update is not available, consider disabling or removing the plugin until a fix is released. Review server logs for unauthorized access to the 'ysleadgen_get_captured_data' AJAX action to identify potential exploitation.

Hi! I’m here to help you understand CVE-2026-1255. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70