What the vulnerability does
01Description
The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpb_admin_ajax function. This makes it possible for unauthenticated attackers to create, update, retitle, or change the post status, slug, and type of arbitrary posts and write ULPB_DATA post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This attack requires the victim to hold an editor-level or administrator session, as the wp_ajax_ulpb_admin_data action enforces a capability check that the forged request must satisfy by inheriting the logged-in user's session cookies.
Explanation of Vulnerability in Simple Terms
02Summary
The Landing Page Builder plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability in versions up to 1.5.3.6. An attacker can craft a malicious webpage that, when visited by a logged-in site administrator, performs unwanted actions on the site without the admin's knowledge or consent. This could allow unauthorized changes to landing pages, settings, or other plugin configurations.
What an attacker can do
03Attacker Capabilities
Perform unwanted actions on the site by tricking an admin into visiting a malicious webpage.
Potential impact on your site
04Site Impact
An attacker could modify landing pages, change plugin settings, or alter site configuration without your permission.
Conditions required to exploit
05Prerequisites
Admin must be logged in and visit a page controlled by the attacker (e.g., via a link in email or social media).
Key dates
06Disclosure timeline
July 16, 2026
CVE published
