Remote Code Execution in DoLeads Integrator and wp2epub Plugins by WordPress
CVE-2026-4375

Currently unrated

Key Information:

Vendor

WordPress
Status
Doleads Integrator
WP2epub
Vendor
CVE Published:
7 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-4375?

The DoLeads Integrator and wp2epub plugins for WordPress allow unauthorized users to install unverified extensions from wordpress.org. This creates a pathway for remote code execution (RCE), jeopardizing website security. Website administrators must ensure that these plugins are updated to mitigate potential exploitation risks.

Affected Version(s)

DoLeads Integrator 0 <= 0.65

wp2epub 0 <= 0.65

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-4375 - Proof of Concept

References

https://wpscan.com/vulnerability/dd043e6c-e6c6-4c8d-aab0-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erwan LR (WPScan)
WPScan
.