EUVD-2026-44858
GHSA-fx4r-pqvc-gggc
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attacker needs no privileges (PR:N); victim must actively click a crafted link (UI:R); impact is limited to post content integrity with no confidentiality or availability breach.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Landing Page Builder - Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpb_admin_ajax function. This makes it possible for unauthenticated attackers to create, update, retitle, or change the post status, slug, and type of arbitrary posts and write ULPB_DATA post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This attack requires the victim to hold an editor-level or administrator session, as the wp_ajax_ulpb_admin_data action enforces a capability check that the forged request must satisfy by inheriting the logged-in user's session cookies.
AnalysisAI
Cross-site request forgery in the Landing Page Builder - Coming Soon Page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin (all versions up to and including 1.5.3.6) allows unauthenticated remote attackers to manipulate arbitrary WordPress posts by sending a forged AJAX request that inherits an authenticated editor or administrator's browser session. Missing nonce validation on the ulpb_admin_ajax function means a victim who clicks a crafted link while logged in unknowingly authorizes post creation, modification of titles, slugs, types, status, and injection of ULPB_DATA post meta. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified; EPSS data was not provided in available intelligence.
Technical ContextAI
The vulnerability is rooted in CWE-352 (Cross-Site Request Forgery) - a failure to validate that an incoming AJAX request originates from the legitimate WordPress admin UI rather than a third-party site. WordPress nonces are time-limited, single-use tokens embedded in admin forms and AJAX handlers to authenticate intent; their absence or incorrect validation breaks this guarantee. The affected code resides in the plugin's admin/classes/ajax-requests-class.php at lines L19 and L111 (confirmed via WordPress SVN references), specifically in the ulpb_admin_ajax function that handles the wp_ajax_ulpb_admin_data action hook. Although this hook enforces a WordPress capability check, the check is satisfied by the victim's active session cookies, which the browser automatically appends to any cross-origin request - precisely the mechanism CSRF exploits. The CPE cpe:2.3:a:umarbajwa:landing_page_builder_-_coming_soon_page,_maintenance_mode,_lead_page,_wordpress_landing_pages:*:*:*:*:*:*:*:* covers all versions of this plugin by vendor 'umarbajwa'.
RemediationAI
The upstream fix is available as changeset 3444409 in the WordPress plugin SVN repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3444409%40page-builder-add&new=3444409%40page-builder-add), which addresses the missing nonce validation in ajax-requests-class.php. Site administrators should update to the version of the plugin that incorporates this changeset as soon as it is released to the WordPress plugin directory; the specific patched release version is not independently confirmed from the available references, so monitor the plugin's changelog at wordpress.org/plugins/page-builder-add. As an interim compensating control, consider deactivating the plugin entirely if coming-soon or maintenance-mode functionality is not actively in use - this eliminates the attack surface with no side effects beyond losing the plugin's features. If the plugin must remain active, instruct all administrator and editor accounts to avoid clicking unsolicited links or visiting untrusted sites while authenticated to WordPress, and consider enforcing logout-on-idle policies to reduce window of exposure. There is no network-layer workaround that blocks this attack since the forged request is indistinguishable from a legitimate one at the HTTP level.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today