LeadConnector < 3.0.22 - Missing Authorization

Vulnerability Research Plan: CVE-2026-1890 (LeadConnector Missing Authorization)

1. Vulnerability Summary

The LeadConnector plugin (versions < 3.0.22) contains a missing authorization vulnerability. Specifically, an AJAX handler or a frontend request processor (triggered via query variables) fails to perform a capability check (e.g., current_user_can('manage_options')) before executing a privileged action. This allows unauthenticated attackers to perform unauthorized actions, such as purging the plugin's CDN cache or potentially modifying plugin settings.

Based on the source code provided and the CVSS vector (5.3 - Integrity Low), the most likely vulnerable function is an AJAX action related to CDN Cache Purging or the processing of the lc_code query variable used for OAuth-like handshakes.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: lc_purge_cache (inferred from admin/app.js and changelog)
• Alternative Endpoint: Homepage GET request with query variables (/?lc_code=...)
• Authentication: None required (unauthenticated).
• Preconditions: The plugin must be active. For the cache purge, settings related to the CDN might need to be "visible" (as per changelog 3.0.19).

3. Code Flow

1. **Entry