External risk intelligence

LeadSnap Unauthenticated PHP Object Injection

Q: What is LeadSnap?

LeadSnap is a plugin for WordPress designed to help users manage, track, and optimize lead generation activities directly within their content management system. As a web application component, it extends standard site functionality to handle incoming visitor data and business inquiries.

Q: What does PHP Object Injection mean in CVE-2026-90888?

This vulnerability, classified as CWE-502, occurs when an application accepts untrusted data and uses it to create an object without proper validation. Because the code trusts this input, an attacker can manipulate the object's structure to change how the program behaves, often resulting in unauthorized command or code execution.

Q: How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to the LeadSnap plugin. Because the vulnerability does not require any prior authentication, simply reaching the target component via the network is sufficient. Normal interactions that do not involve sending malicious, serialized PHP objects will not trigger this behavior.

Q: Is my environment at risk based on Halo Surface Signal?

According to Halo Surface Signal, this vulnerability is likely relevant to your environment because the affected software is a WordPress plugin. These components are typically installed on web servers designed to be internet-facing to communicate with site visitors. If your site is accessible from the public internet, the component is exposed to potential remote requests.

Q: What are the first steps to address this CVE?

Begin by auditing your infrastructure to identify all instances where the LeadSnap plugin is active. Once located, determine if these instances are internet-facing or limited to internal networks. After identifying the scope, coordinate with the appropriate application owners to plan for updates or removal, ensuring the affected code is no longer accessible to attackers.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-90888

The vulnerability affects a WordPress plugin, which is a type of web application component designed to be deployed on internet-facing web servers. As a public-facing web application feature, it is commonly accessible via the internet in standard deployment patterns.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the LeadSnap software, specifically an unauthenticated PHP Object Injection flaw. This type of issue could allow an attacker to remotely execute code on affected systems without needing any credentials, potentially leading to a full compromise of the application and its data. The main concern at this stage is confirming whether our environment utilizes this specific software.

Allows remote code execution without login.
Critical flaw in commonly exposed web component.
Verify if LeadSnap is in use within our systems.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a crafted request to a web application that uses the affected component. This could allow them to inject malicious PHP objects, potentially leading to the execution of arbitrary code on the server.

No authentication is required.
Triggered by crafted web requests.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious PHP code, potentially leading to unauthorized access, modification, or deletion of data. The attack could be executed over the network without any user interaction when the affected component is accessible.

System data and service behavior.
Via network requests without authentication.
Full system compromise is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions presents a critical risk, particularly given its network-exploitable nature. Responsibility for addressing this will likely fall to application owners, platform teams, and potentially vendor management if LeadSnap is a third-party integration. The immediate first step should be to locate all instances of LeadSnap, assess their exposure and business criticality, and then determine the accountable team for remediation planning and execution.

Application owners should address this issue.
Verify LeadSnap instances and their exposure.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LeadSnap?

LeadSnap is a plugin for WordPress designed to help users manage, track, and optimize lead generation activities directly within their content management system. As a web application component, it extends standard site functionality to handle incoming visitor data and business inquiries.

What does PHP Object Injection mean in CVE-2026-90888?

This vulnerability, classified as CWE-502, occurs when an application accepts untrusted data and uses it to create an object without proper validation. Because the code trusts this input, an attacker can manipulate the object's structure to change how the program behaves, often resulting in unauthorized command or code execution.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network request to the LeadSnap plugin. Because the vulnerability does not require any prior authentication, simply reaching the target component via the network is sufficient. Normal interactions that do not involve sending malicious, serialized PHP objects will not trigger this behavior.

Is my environment at risk based on Halo Surface Signal?