EUVD-2026-72650
GHSA-8x3r-6f6w-g9jx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege WordPress account
-
DeliveryIdentify unprotected plugin action endpoint
-
ExploitSend crafted POST request omitting capability check
-
ExecutionPlugin executes privileged destructive action
-
ImpactLanding pages disrupted or deleted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated WordPress user account with at minimum low-level privileges (subscriber, contributor, or equivalent role) on the target WordPress installation. The Unbounce Landing Pages plugin must be installed and active at version 1.1.4 or earlier. Sites that restrict WordPress user registration to trusted parties are at significantly lower risk. The CVSS vector (PR:L) explicitly confirms that unauthenticated exploitation is not possible - a valid session cookie is a hard prerequisite. There are no reported requirements for a specific WordPress configuration, non-default settings, or particular server environment beyond the plugin being present. |
| Impact | The CVSS 7.1 score is grounded in a realistic attack profile: network-accessible (AV:N), low complexity (AC:L), requires low-privilege authentication (PR:L), no user interaction (UI:N), with high availability (A:H) and low integrity (I:L) impacts. No EPSS score is provided in available data, and the absence of both KEV listing and public POC code lowers immediate urgency. The 'Authentication Bypass' tag in the source metadata is misleading - the CVSS vector specifies PR:L, confirming that a valid authenticated session is required; this is broken access control, not true authentication bypass. Real-world risk is moderate and constrained: opportunistic mass exploitation is unlikely because a valid WordPress account on each target site is a prerequisite, but insider threats or sites with open user registration represent plausible attack paths. The high availability impact is the primary concern for production marketing sites relying on landing pages for campaigns. |
| Exploit ScenarioDerived | An attacker registers or obtains a low-privilege WordPress account (e.g., subscriber) on a site running Unbounce Landing Pages ≤1.1.4. They send a crafted HTTP POST request directly to the plugin's insufficiently protected AJAX or admin-post endpoint, bypassing the intended capability gate. The server executes the privileged action - most likely disrupting, deleting, or corrupting landing page configurations - without the user holding the required WordPress capability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Missing authorization in the Unbounce Landing Pages WordPress plugin (≤1.1.4) allows authenticated low-privilege users to exploit incorrectly configured access control, resulting in high availability impact and limited integrity modification. The CVSS vector (PR:L, A:H, I:L) indicates that a logged-in WordPress user with minimal permissions can invoke plugin actions without proper capability checks - most likely disrupting or deleting landing page content. No public exploit code or CISA KEV listing exists at time of analysis.
RemediationAI
Update the Unbounce Landing Pages plugin to a version above 1.1.4. The specific patched version number is not confirmed in available data - verify the latest release via the WordPress plugin repository and cross-reference with the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/unbounce/vulnerability/wordpress-unbounce-landing-pages-plugin-1-1-4-broken-access-control-vulnerability before upgrading. As an interim compensating control, disable open user registration on the WordPress site to limit the pool of potential low-privilege attackers, though this does not eliminate risk from existing accounts. Auditing which user roles have access to the site and removing unnecessary accounts reduces exposure further. Note that disabling open registration may affect legitimate workflows if the site relies on subscriber self-enrollment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-862 (Missing Authorization) describes a failure to verify whether an authenticated actor holds the required permission before executing a sensitive operation. In WordPress plugins, this manifests as absent or insufficient calls to current_user_can() or equivalent capability checks before handling AJAX, REST, or admin-post requests. The affected product, identified by CPE cpe:2.3:a:unbounce:unbounce_landing_pages:*:*:*:*:*:*:*:*, is the official Unbounce landing page builder integration for WordPress, which connects WordPress sites to the Unbounce SaaS platform for campaign management. The missing check allows low-privileged roles (subscriber, contributor, or similar) to trigger actions reserved for editors or administrators, with the high availability impact suggesting destructive operations such as page removal or configuration reset are reachable.
Know when Unbounce Landing Pages gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Network-reachable plugin endpoint; low-privilege authenticated account required; no confidentiality impact; high availability from likely destructive action.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Unbounce Landing Pages: from n/a through 1.1.4.
Articles & Coverage 2
Executive ViewAI
The Unbounce Landing Pages WordPress plugin (versions ≤1.1.4) lacks proper access controls, allowing any logged-in WordPress user with minimal permissions to disrupt or modify landing page content, impacting marketing infrastructure availability. Organizations using this plugin face unplanned downtime and potential data loss affecting revenue-generating conversion assets. Immediate action is required to restrict user access until a vendor patch becomes available.
Restrict low-privilege WordPress user roles from accessing Unbounce plugin settings using capability management tools or custom role plugins. Enable WordPress audit logging to detect unauthorized landing page modifications. Use security-hardened WordPress plugins to enforce access restrictions and require administrator approval for all page changes. Segregate landing page management to administrator-only accounts until patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB