CVE-2026-85574

Overview

The Unbounce Landing Pages WordPress plugin prior to version 1.1.5 lacks proper authorization checks when updating its front-end proxy configuration. This flaw enables low-privileged authenticated users, such as subscribers, to redirect the proxy to arbitrary external hosts and serve unauthorized content under the trusted site origin.

Description

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

Impact

The vulnerability primarily impacts the integrity and availability of the affected WordPress site by allowing unauthorized content injection from attacker-controlled sources under the victim site's origin. Low-privileged authenticated users, such as subscribers, can exploit this to perform server-side request redirection and content spoofing. Confidentiality impact is minimal, but the integrity of served content is compromised.

Remediation

Update the Unbounce Landing Pages WordPress plugin to version 1.1.5 or later immediately. Ensure strict role-based access controls are enforced for all administrative and configuration-updating endpoints within the plugin.

Risk context

The vulnerability carries a CVSS v3 score of 8.0, indicating high severity due to the potential for unauthorized configuration changes and content injection by low-privileged users. The current EPSS score is 0.00132, reflecting a relatively low observed exploitation probability in the wild at this time, but urgent patching is still recommended given the ease of exploitation.

Affected products

• Unbounce Landing Pages WordPress plugin