CVE-2026-4375: Unauthenticated RCE in DoLeads Integrator & wp2epub Plugins

Vulnerability Overview Vulnerability Name: DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE Description: These plugins are used to achieve Remote Code Execution (RCE). Once added to a blog, such as through an unrevoked extension installed from wordpress.org, unauthorized users can exploit this vulnerability. CVE ID: CVE-2026-4375 Classification: - Type: RCE - OWASP Top 10: A1: Injection - CWE: CWE-94 - CVSS Score: 9.0 (Critical) Affected Scope Affected Plugins: - DoLeads Integrator: No known fix available - wp2epub: No known fix available Remediation Remediation Status: No known fix available Timeline Public Disclosure Date: 2026-06-16 Added Date: 2026-06-16 Last Updated Date: 2026-06-16 Additional Information Original Researcher: Erwan LR (WPScan) Submitter: Erwan LR (WPScan) Validation Status: Verified WPVDB ID: dd043e6c-e6c6-4c8d-aab0-5265d28f5cf6 Related Vulnerabilities JetEngine < 3.8.1.2 - Authenticated (Contributor+) Remote Code Execution Soledad < 8.6.8 - Unauthenticated Arbitrary Shortcode Execution Code Snippets CPT <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution WPLMS < 1.9.9.5 - Authenticated (Student+) Remote Code Execution Everest Forms < 3.4.2 - Unauthenticated Arbitrary Shortcode Execution POC Code POC Code: No specific POC code is provided on the page, only indicating that "POC will be displayed after the issue is fixed." --- The above is a summary of key vulnerability information from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-4375: Unauthenticated RCE in DoLeads Integrator & wp2epub Plugins

More from this source