CVE-2026-90888 disclosed in LeadSnap PHP plugin
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- LeadSnap
- Product
- LeadSnap
- First seen
Summary
CVE-2026-90888 is an unauthenticated PHP object injection vulnerability, rated Critical (9.8), in LeadSnap versions up to and including 1.25 as reported by TheHackerWire. The item states the flaw requires no authentication.
If you use LeadSnap
Check whether LeadSnap is installed and at version 1.25 or earlier
Update to a patched release from the vendor once available
Disable LeadSnap on affected sites if no fix is available
Update LeadSnap to a version later than 1.25 immediately
Disable LeadSnap if no patch is available
Review logs for unexpected requests to LeadSnap endpoints
What the sources say 2
· Mastodon: “🔴 CVE-2026-90888 - Critical (9.8) Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.” Source
· Mastodon: “Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.” Source