Unbounce Landing Pages CVE-2026-85574

Requires the Unbounce Landing Pages plugin (versions 1.1.1 through before 1.1.5) installed and using its front-end proxy feature. The attacker needs an authenticated account of any privilege level, explicitly including subscriber (PR:L) - practical where WordPress user self-registration is enabled. Exploitation is a missing-authorization flaw: the config-update endpoint that controls the proxy target performs no capability/authorization check. Realized impact against high-value victims requires user interaction (UI:R): a site visitor or administrator must load the proxied path so the attacker-controlled content is served from the site's origin. Limiting factors: needs a valid low-privileged login (not fully unauthenticated), the proxy feature must be relied upon, and the most damaging outcomes depend on a victim visiting the poisoned page.

This is a genuine mid-to-high priority for sites running the affected plugin, but the raw vendor CVSS of 8.0 slightly overstates it. Signals in agreement: the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R) shows network-reachable, low-complexity exploitation requiring only a low-privileged authenticated account, and a public POC exists (WPScan), which raises the practical exploitability above a theoretical bug. Signals that temper it: PR:L means it is NOT unauthenticated - an attacker needs at least a subscriber account (realistic on WordPress sites with open registration, but still a gate), and UI:R means impact against high-value targets (session/cookie theft, admin compromise) depends on a victim actually loading the attacker-poisoned proxied page. There is no EPSS score, no CISA KEV listing, and no SSVC data provided, so there is no evidence of mass or automated exploitation - treat this as a patch-promptly item rather than an emergency. The vendor's C:H/I:H/A:H is defensible for confidentiality (attacker-served JavaScript executes in the site's own trusted origin, enabling cookie/session theft) and integrity (arbitrary content/defacement from the origin), but the A:H (availability) rating is weakly justified by the description and should be verified - serving malicious content does not obviously deny service. The 'Authentication Bypass' tag is misleading: this is a missing-authorization flaw (CWE-862), not an authentication bypass, since the attacker must already be authenticated.

An attacker registers a low-privileged (subscriber) account on a WordPress site running Unbounce Landing Pages < 1.1.5, then sends a request updating the front-end proxy configuration - which performs no authorization check - to point the proxy at a host the attacker controls. When a visitor or administrator subsequently loads the proxied path, attacker-controlled content (e.g., malicious JavaScript) is served from the site's own origin, enabling content spoofing or session/cookie theft. A public proof-of-concept is available from WPScan, lowering the barrier to reproduction.