Unbounce Landing Pages
Monthly
Missing authorization in the Unbounce Landing Pages WordPress plugin (version 1.1.1 through versions before 1.1.5) lets any authenticated user, including a subscriber-level account, rewrite the target host of the plugin's front-end proxy and cause attacker-controlled content to be served from the victim site's own origin. Publicly available exploit code exists, and the plugin is patched in 1.1.5, but no CISA KEV entry was identified at time of analysis. The vendor's CVSS score of 8.0 is slightly generous: exploitation requires a valid low-privileged login (practical where self-registration is enabled) and, for the most damaging outcomes, a visitor or administrator must load the poisoned proxied path, which is why our independent assessment lowers availability impact to None while keeping confidentiality and integrity at High.
Missing authorization in the Unbounce Landing Pages WordPress plugin (≤1.1.4) allows authenticated low-privilege users to exploit incorrectly configured access control, resulting in high availability impact and limited integrity modification. The CVSS vector (PR:L, A:H, I:L) indicates that a logged-in WordPress user with minimal permissions can invoke plugin actions without proper capability checks - most likely disrupting or deleting landing page content. No public exploit code or CISA KEV listing exists at time of analysis.
Missing authorization in the Unbounce Landing Pages WordPress plugin (version 1.1.1 through versions before 1.1.5) lets any authenticated user, including a subscriber-level account, rewrite the target host of the plugin's front-end proxy and cause attacker-controlled content to be served from the victim site's own origin. Publicly available exploit code exists, and the plugin is patched in 1.1.5, but no CISA KEV entry was identified at time of analysis. The vendor's CVSS score of 8.0 is slightly generous: exploitation requires a valid low-privileged login (practical where self-registration is enabled) and, for the most damaging outcomes, a visitor or administrator must load the poisoned proxied path, which is why our independent assessment lowers availability impact to None while keeping confidentiality and integrity at High.
Missing authorization in the Unbounce Landing Pages WordPress plugin (≤1.1.4) allows authenticated low-privilege users to exploit incorrectly configured access control, resulting in high availability impact and limited integrity modification. The CVSS vector (PR:L, A:H, I:L) indicates that a logged-in WordPress user with minimal permissions can invoke plugin actions without proper capability checks - most likely disrupting or deleting landing page content. No public exploit code or CISA KEV listing exists at time of analysis.