Cross-Site Request Forgery Vulnerability in WP Landing Page for WordPress

CVE-2025-13629

What is CVE-2025-13629?

The WP Landing Page plugin for WordPress is susceptible to a Cross-Site Request Forgery vulnerability, present in all versions up to 0.9.3. This vulnerability arises from a lack of nonce validation in the 'wplp_api_update_text' function, allowing unauthorized users to exploit this weakness. By tricking a site administrator into clicking a malicious link, attackers can execute arbitrary updates to post metadata, posing significant risks to site integrity and data security.

References