Unauthorized Configuration Update in Unbounce Landing Pages Plugin for WordPress
CVE-2026-85574
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 September 2026
Badges
What is CVE-2026-85574?
The Unbounce Landing Pages plugin for WordPress prior to version 1.1.5 is vulnerable to an authorization bypass issue. This vulnerability allows authenticated users, including those with low privilege accounts like subscribers, to manipulate the configuration used by the plugin's front-end proxy. Without proper authorization checks, an attacker can direct the proxy to a malicious host under their control, enabling them to serve arbitrary content from the website's origin, which poses significant security risks and could lead to content spoofing or phishing attacks.
Affected Version(s)
Unbounce Landing Pages 1.1.1 < 1.1.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.