CVE-2026-1255 ysinnovations CVE debrief

Who should care

Defenders responsible for WordPress installations with the YS LeadGen plugin should assess exposure and prioritize remediation. This includes verifying YS LeadGen plugin versions in use, restricting access to the vulnerable AJAX action, and monitoring for unauthorized access to captured form submission data. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, re

Why it matters

The YS LeadGen plugin for WordPress has a Sensitive Information Exposure vulnerability, allowing unauthenticated attackers to retrieve captured form submission data, including PII. Defenders should prioritize verifying exposure and restricting access to the vulnerable AJAX action.

• Unauthenticated access to sensitive form submission data
• Potential exposure of personally identifiable information (PII)
• Need for verification of YS LeadGen plugin versions in use
• Prioritization of restricting access to the 'ysleadgen_get_captured_data' AJAX action

Technical summary

The YS LeadGen plugin for WordPress has a Sensitive Information Exposure vulnerability in all versions up to, and including, 2.1.4. The 'ysleadgen_get_captured_data' AJAX action is accessible to unauthenticated users, allowing them to retrieve all captured form submission data, including personally identifiable information (PII). Defenders should prioritize verifying exposure of YS LeadGen plugin versions up to 2.1.4 and restrict access to the 'ysleadgen_get_captured_data' AJAX action. This vulnerability makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted

Defensive priority

Defenders should prioritize verifying exposure of YS LeadGen plugin versions up to 2.1.4 and restrict access to the 'ysleadgen_get_captured_data' AJAX action.

Recommended defensive actions

• Verify YS LeadGen plugin versions up to 2.1.4 are not in use
• Restrict access to the 'ysleadgen_get_captured_data' AJAX action
• Monitor for unauthorized access to captured form submission data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the YS LeadGen plugin for WordPress. The 'ysleadgen_get_captured_data' AJAX action is accessible to unauthenticated users, allowing them to retrieve captured form submission data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.