CVE-2025-13496: Moosend Landing Pages Auth Bypass Flaw

CVE-2025-13496 Overview

The Moosend Landing Pages plugin for WordPress contains a missing capability check vulnerability in the moosend_landings_auth_get function. This authorization bypass affects all versions up to and including 1.1.6, allowing authenticated attackers with Subscriber-level access or above to delete the moosend_landing_api_key option value without proper authorization.

Critical Impact

Authenticated users with minimal privileges can modify plugin configuration data, potentially disrupting the integration between WordPress and Moosend services and breaking landing page functionality.

Affected Products

• Moosend Landing Pages plugin for WordPress versions up to and including 1.1.6
• WordPress installations utilizing the Moosend Landing Pages plugin

Discovery Timeline

• January 7, 2026 - CVE-2025-13496 published to NVD
• January 8, 2026 - Last updated in NVD database

Technical Details for CVE-2025-13496

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), which occurs when the software does not perform an authorization check when an actor attempts to access a resource or perform an action. The moosend_landings_auth_get function in the Moosend Landing Pages plugin fails to verify that the requesting user has the appropriate capabilities before processing the request.

The vulnerability allows any authenticated WordPress user, even those with the lowest Subscriber role, to invoke the vulnerable function. When exploited, this results in the deletion of the moosend_landing_api_key option from the WordPress database, which stores the API credentials necessary for the plugin to communicate with Moosend's email marketing platform.

Root Cause

The root cause is a missing capability check in the moosend_landings_auth_get function located in forms/auth-request.php. WordPress plugins should implement proper authorization checks using functions like current_user_can() to verify that users have appropriate permissions before executing sensitive operations. The vulnerable code path does not include these checks, allowing any authenticated user to trigger the function regardless of their role or capabilities.

Attack Vector

The attack is conducted over the network and requires authentication with any WordPress user account. An attacker who has compromised or created a Subscriber-level account can send requests to the vulnerable endpoint. The exploitation requires no user interaction and has low complexity. The successful exploitation results in unauthorized data modification, specifically the deletion of the API key configuration, which can disrupt the plugin's functionality and affect business operations dependent on Moosend integration.

The vulnerability can be exploited by crafting HTTP requests that target the authentication handling functionality within the plugin. Since no capability check exists, the WordPress authentication system alone is insufficient to prevent the attack.

Detection Methods for CVE-2025-13496

Indicators of Compromise

• Unexpected modifications or deletions of the moosend_landing_api_key option in the WordPress wp_options table
• Failed Moosend API connections or broken landing page functionality following unexplained configuration changes
• Suspicious HTTP requests to the plugin's auth-request.php endpoint from low-privilege user sessions
• Audit log entries showing Subscriber or Contributor-level users accessing plugin administrative functions

Detection Strategies

• Implement WordPress database monitoring to track changes to the wp_options table, specifically for the moosend_landing_api_key option
• Deploy web application firewall (WAF) rules to detect and alert on requests to the vulnerable moosend_landings_auth_get endpoint from non-administrative users
• Enable and review WordPress audit logging to identify unauthorized access patterns from low-privilege accounts
• Monitor for plugin functionality failures that may indicate successful exploitation

Monitoring Recommendations

• Configure SentinelOne Singularity to monitor WordPress application directories for suspicious activity patterns
• Implement alerting on unexpected option value deletions within the WordPress database
• Establish baseline behavior for plugin-related API calls and alert on deviations
• Review user activity logs regularly for Subscriber accounts performing administrative actions

How to Mitigate CVE-2025-13496

Immediate Actions Required

• Update the Moosend Landing Pages plugin to a version newer than 1.1.6 that includes the security fix
• Audit recent changes to the moosend_landing_api_key option to determine if exploitation has occurred
• Review and remove any unnecessary Subscriber-level accounts that may have been created by attackers
• Temporarily disable the Moosend Landing Pages plugin if an update is not immediately available and the plugin is not critical to operations

Patch Information

Users should update to the latest version of the Moosend Landing Pages plugin from the WordPress plugin repository. The vulnerability exists in versions up to and including 1.1.6. The fix should implement proper capability checks using WordPress's authorization functions. For technical details on the vulnerable code, refer to the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Workarounds

• Restrict user registration on WordPress sites to prevent attackers from creating accounts with Subscriber privileges
• Implement additional access control layers using security plugins that can restrict access to plugin functionality based on user roles
• Use a Web Application Firewall (WAF) to filter requests to the vulnerable endpoint from non-administrative users
• Consider implementing IP-based restrictions for administrative functions if your environment supports it

# WordPress wp-config.php - Disable user registration as a temporary mitigation
# Add or modify the following line in wp-config.php:
define('WP_ALLOW_MULTISITE', false);

# Alternatively, in WordPress admin: Settings > General > uncheck "Anyone can register"