What the vulnerability does
01Description
The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page source of the website. This makes it possible for unauthenticated attackers to inject arbitrary content into the log files, and when combined with another vulnerability this could have significant consequences.
Explanation of Vulnerability in Simple Terms
02Summary
SALESmanago & Leadoo versions 3.2.4 and earlier contain an integrity vulnerability that allows unauthenticated attackers to modify data over the network. The vulnerability requires no user interaction and affects the integrity of information stored in the system. No confidentiality or availability impact is present.
What an attacker can do
03Attacker Capabilities
Modify data in the application without authentication.
Potential impact on your site
04Site Impact
Attackers can alter data integrity without logging in, potentially corrupting records or configurations.
Conditions required to exploit
05Prerequisites
Network access to the affected system; no authentication or user interaction required.
Key dates
06Disclosure timeline
October 21, 2023
CVE published
April 8, 2026
Record updated
