CVE-2026-85574: Unbounce Landing Pages Auth Bypass Flaw

CVE-2026-85574 Overview

CVE-2026-85574 is a missing authorization vulnerability [CWE-862] in the Unbounce Landing Pages WordPress plugin before version 1.1.5. The plugin fails to perform any authorization check when updating the configuration used by its front-end proxy. Any authenticated user, including a low-privileged subscriber, can point the proxy at an attacker-controlled host. Arbitrary content is then served from the victim site's own origin, enabling content spoofing, phishing, and downstream client-side attacks.

Critical Impact
Authenticated subscribers can hijack the plugin's front-end proxy and serve attacker-controlled content from the trusted WordPress origin, undermining confidentiality, integrity, and availability.

Affected Products

Unbounce Landing Pages WordPress plugin versions prior to 1.1.5
WordPress sites with the plugin installed and open user registration or existing low-privilege accounts
Any origin serving proxied content through the plugin's front-end proxy configuration

Discovery Timeline

2026-09-19 - CVE-2026-85574 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-85574

Vulnerability Analysis

The Unbounce Landing Pages plugin exposes an endpoint that updates the configuration for its front-end proxy component. This configuration determines which upstream host the proxy fetches content from before returning it under the WordPress site's origin. The endpoint does not verify the caller's role or capabilities. Any authenticated session, including the default subscriber role, can submit a configuration update and redirect the proxy target.

Once the proxy is redirected, visitors requesting affected paths receive attacker-controlled HTML, JavaScript, or other assets delivered from the trusted domain. Because the content is served same-origin, it inherits cookies, session context, and any trust the browser assigns to the WordPress site. This enables convincing phishing pages, credential harvesting, arbitrary script execution against authenticated visitors, and site defacement. Full details are available in the WPScan Vulnerability Report.

Root Cause

The root cause is a missing authorization check [CWE-862] on the configuration update handler. The plugin verifies authentication but does not enforce a capability check such as current_user_can('manage_options') or a matching nonce tied to an administrator context.

Attack Vector

An attacker registers or logs in as any authenticated user, then issues a crafted request to the plugin's configuration update endpoint. The request sets the proxy upstream to a host under attacker control. Subsequent visitor requests to proxied paths are served attacker content from the victim origin. Exploitation requires only low privileges and user interaction on the delivery side.

Refer to the WPScan Vulnerability Report for endpoint specifics.

Detection Methods for CVE-2026-85574

Indicators of Compromise

Unexpected modifications to the Unbounce plugin's proxy configuration in the WordPress wp_options table or plugin-specific settings tables
Outbound HTTP requests from the WordPress host to unfamiliar external domains referenced by the proxy configuration
Visitor-facing pages returning content that does not match the site's authored landing pages
Access log entries showing subscriber-level accounts issuing POST requests to plugin administrative endpoints

Detection Strategies

Audit WordPress user activity for low-privilege accounts invoking plugin configuration endpoints
Compare current plugin proxy settings against a known-good baseline and alert on drift
Inspect served landing page responses for unexpected script sources, redirects, or third-party form actions

Monitoring Recommendations

Enable WordPress audit logging for option changes and REST API calls made by non-administrator users
Forward web server access logs and WordPress audit events to a centralized analytics platform for correlation
Monitor egress traffic from WordPress hosts and alert on new upstream destinations contacted by PHP processes

How to Mitigate CVE-2026-85574

Immediate Actions Required

Update the Unbounce Landing Pages plugin to version 1.1.5 or later on all WordPress installations
Review the plugin's proxy configuration and reset it to a known-good upstream value
Audit user accounts and remove or reset credentials for unrecognized subscriber-level users
Rotate authenticated session tokens and review recent option changes for evidence of tampering

Patch Information

The vendor addressed CVE-2026-85574 in version 1.1.5 of the Unbounce Landing Pages plugin by adding an authorization check to the proxy configuration update handler. Administrators should apply this update through the WordPress plugin dashboard or by pulling the updated release from the WordPress plugin repository. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Unbounce Landing Pages plugin until the patched version can be deployed
Close open user registration or restrict the default new-user role away from any account tier that can reach the plugin's endpoints
Place the WordPress admin and plugin REST endpoints behind IP allowlists or a web application firewall rule that blocks non-administrator sessions

bash

# Configuration example
wp plugin update unbounce-landing-pages --version=1.1.5
wp option update users_can_register 0