CVE-2026-81781: Unbounce Landing Pages Auth Bypass Flaw

CVE-2026-81781 Overview

CVE-2026-81781 is a missing authorization vulnerability in the Unbounce Landing Pages plugin for WordPress. The flaw affects all versions up to and including 1.1.4. Authenticated attackers with low privileges can exploit incorrectly configured access control checks to reach functionality reserved for higher-privileged users. The weakness is classified under CWE-862: Missing Authorization.

Successful exploitation can lead to unauthorized modification of plugin state and disruption of site availability. The vulnerability is exploitable over the network and requires no user interaction.

Critical Impact

Authenticated low-privilege users can bypass access control checks in the Unbounce Landing Pages plugin, leading to integrity impact and denial of service on affected WordPress sites.

Affected Products

• Unbounce Landing Pages WordPress plugin versions through 1.1.4
• WordPress sites running the unbounce plugin with any authenticated user role
• WordPress deployments that permit subscriber-level or higher registration

Discovery Timeline

• 2026-09-08 - CVE-2026-81781 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-81781

Vulnerability Analysis

The Unbounce Landing Pages plugin exposes plugin actions without enforcing appropriate capability checks. WordPress plugins typically gate privileged operations using current_user_can() checks combined with nonce validation. The affected code paths accept requests from any authenticated session, regardless of the user's role.

This broken access control pattern allows a subscriber-level account to invoke actions intended for administrators. The Patchstack advisory categorizes the flaw as a broken access control issue in the plugin's request handlers.

Root Cause

The root cause is missing or insufficient authorization logic in plugin endpoints. The handlers verify only that a request originates from a logged-in user, not that the user holds the required capability. WordPress endpoints registered through admin-ajax.php or the REST API require explicit permission callbacks to prevent this class of issue.

Attack Vector

An attacker with any authenticated WordPress account sends crafted requests to the vulnerable plugin endpoints. Because the plugin does not validate the caller's role, the requests execute successfully. The attack requires network access to the WordPress site and low privileges, with no user interaction on the victim side.

No public proof-of-concept exploit is currently available. Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-81781

Indicators of Compromise

• Unexpected requests to admin-ajax.php referencing Unbounce plugin actions from low-privilege user sessions
• Modifications to landing page configurations or plugin options made by non-administrator accounts
• Newly registered subscriber accounts generating administrative-scope API calls shortly after login

Detection Strategies

• Review WordPress audit logs for plugin actions performed by users lacking administrator capabilities
• Correlate authenticated session activity with plugin endpoint invocations to identify role mismatches
• Inspect web server access logs for POST requests to Unbounce plugin routes originating from unusual accounts

Monitoring Recommendations

• Enable a WordPress activity log plugin to capture user role, action, and target object for every request
• Forward WordPress and web server logs to a centralized SIEM for retention and correlation
• Alert on any change to plugin settings performed outside of a defined administrator user set

How to Mitigate CVE-2026-81781

Immediate Actions Required

• Update the Unbounce Landing Pages plugin to a version later than 1.1.4 once released by the vendor
• Audit all WordPress user accounts and remove unused subscriber or contributor accounts
• Disable open user registration on WordPress sites that do not require it

Patch Information

At the time of publication, the Patchstack Vulnerability Report lists versions through 1.1.4 as affected. Site operators should monitor the WordPress plugin repository for a fixed release and apply the update immediately once available.

Workarounds

• Deactivate the Unbounce Landing Pages plugin until a patched version is installed
• Restrict access to /wp-admin/admin-ajax.php and plugin REST routes using a web application firewall rule set
• Enforce least-privilege role assignments and require multi-factor authentication for all WordPress accounts

# Example: disable the plugin via WP-CLI until a patch is available
wp plugin deactivate unbounce
wp user list --role=subscriber --field=ID | xargs -I {} wp user get {} --fields=ID,user_login,user_registered