Description

The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-19T09:16:34.030Z",
  "pubdate": "2026-09-19T09:16:34.030Z",
  "executiveSummary": "The YS LeadGen WordPress plugin contains a critical Sensitive Information Exposure vulnerability affecting all versions up to and including 2.1.4.\nThe flaw stems from an improperly secured AJAX action, 'ysleadgen_get_captured_data', which is accessible to unauthenticated remote attackers.\nThis vulnerability allows unauthorized third parties to exfiltrate the entirety of the plugin's captured lead data, including Personally Identifiable Information (PII) such as full names, email addresses, and submission messages.\nThe risk is categorized as high, as the exploitation requires no authentication or special privileges, making it accessible to any network-adjacent attacker.\nSuccessful exploitation results in a complete breach of data privacy, potentially violating regulatory compliance frameworks such as GDPR or CCPA by exposing user submission data stored within the WordPress database.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of AJAX hooks within the YS LeadGen plugin. Specifically, the 'ysleadgen_get_captured_data' function is registered via the WordPress AJAX API without adequate capability checks or nonces to verify the requestor's identity or authorization level.\nIn WordPress, AJAX actions intended for backend administrative use must be explicitly protected. Developers typically achieve this by checking the user's role using 'current_user_can()' or verifying a security token (nonce) to prevent unauthorized access. The YS LeadGen plugin fails to perform these essential access control checks, leaving the function exposed to the public.\nThe attack flow begins with an unauthenticated attacker sending a crafted HTTP POST request to the WordPress 'admin-ajax.php' endpoint. The request must include the 'action' parameter set to 'ysleadgen_get_captured_data'. Because the handler lacks authentication logic, the server executes the function and retrieves the captured form submission data from the database.\nOnce the function is invoked, the plugin logic serializes the database entries containing the PII—which may include names, contact details, and sensitive message bodies—and returns the data in the response body, typically formatted as JSON. The attacker intercepts this response, gaining full visibility into the captured leads without interacting with the legitimate frontend or backend administrative interfaces.\nThis vulnerability is classified as an Unauthenticated Sensitive Information Disclosure. It does not require any prior knowledge of the target system beyond the existence of the plugin. The exposure is total, meaning all records captured by the plugin are accessible. This represents a significant post-exploitation risk, as the exfiltrated PII can be utilized for secondary attacks, such as targeted phishing, identity theft, or reconnaissance against the site's user base.\nThe vulnerability is present in all versions of the YS LeadGen plugin through version 2.1.4. The exposure exists regardless of the WordPress site configuration, provided the plugin is active and has successfully captured at least one form submission in the database."
}