CVE-2026-1255: YS LeadGen WordPress Plugin Leaks Captured Lead Data

Overview

The YS LeadGen – Popup Builder, Popup Maker & Form Builder plugin for WordPress is vulnerable to sensitive information exposure, tracked as CVE-2026-1255 and rated 7.5 (High) on CVSS 3.1. The plugin registers an AJAX action, ysleadgen_get_captured_data, without any authentication or capability check — meaning anyone who can reach admin-ajax.php can pull every form submission the plugin has ever captured. The issue affects all versions up to and including 2.1.4.

Technical Details

How It Works

ysleadgen_get_captured_data is hooked without a nonce check or a current_user_can() capability gate, and it is registered as a wp_ajax_nopriv_* action — meaning it's reachable by logged-out visitors. A simple POST (or GET) request to wp-admin/admin-ajax.php with action=ysleadgen_get_captured_data returns the full set of captured lead-form submissions with no verification of who is asking.

Impact Assessment

Any site running a vulnerable version and using YS LeadGen's popups or forms to collect visitor information is exposed. Captured data can include:

• Names and email addresses
• Free-text message content submitted through forms
• Any other custom fields the site owner configured in their lead forms

For sites collecting contact details, sales inquiries, or other PII through YS LeadGen popups, this is a straightforward, unauthenticated bulk data-scraping vector — no social engineering or credential theft required.

The companion issue, CVE-2026-1256, compounds the risk: missing capability checks on popup-management AJAX endpoints allow authorization bypass and stored XSS, which could be chained with this disclosure for further site compromise.

Mitigation

• Update to YS LeadGen 1.1.5 or later immediately. The fix restricts captured-lead access to authenticated administrators, adds nonce validation and capability checks, and removes the unauthenticated (nopriv) AJAX registration.
• If immediate updating isn't possible, disable the plugin or block direct access to the vulnerable AJAX action at the web server/WAF layer as a stopgap.
• Audit lead-form data already collected for signs of prior scraping (e.g., unusual request volumes to admin-ajax.php with the ysleadgen_get_captured_data action in server logs).
• Sites that handle sensitive PII through third-party form plugins should generally restrict AJAX exposure by default and require capability checks on any action that returns stored user data.

References

• NVD — CVE-2026-1255
• Wordfence Intelligence — YS LeadGen Plugin