The YS LeadGen WordPress plugin is vulnerable to an unauthenticated information disclosure flaw that allows attackers to exfiltrate sensitive user form data.

This vulnerability is an exposure of sensitive information (CWE-200) caused by an improper capability check within the ysleadgen_get_captured_data AJAX action. The flaw allows any unauthenticated attacker to remotely query the database and retrieve personally identifiable information (PII) submitted through the plugin.

Successful exploitation of this vulnerability results in the unauthorized access and exfiltration of PII, such as email addresses and message content. Given the CVSS score of 7.5, this high-severity flaw poses significant risks regarding regulatory non-compliance (such as GDPR or CCPA) and potential reputational damage due to data leakage.

Immediate Action: Update the YS LeadGen plugin to version 2.1.5 or later immediately. If an update is not currently possible, deactivate and remove the plugin from the WordPress environment.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the /wp-admin/admin-ajax.php endpoint, specifically looking for repeated calls to the ysleadgen_get_captured_data action from unknown IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing the ysleadgen_get_captured_data parameter if the plugin cannot be updated immediately, though this should be considered a temporary measure.

Public Exploit Available: Unknown

Organizations utilizing the YS LeadGen plugin must prioritize upgrading to version 2.1.5 to close this security gap. Because this vulnerability allows for the silent exfiltration of user data without requiring authentication, immediate patching is essential to prevent unauthorized access to sensitive information.