CVE-2026-85574 Overview
CVE-2026-85574 is a missing authorization vulnerability [CWE-862] in the Unbounce Landing Pages WordPress plugin before version 1.1.5. The plugin fails to perform any authorization check when updating the configuration used by its front-end proxy. Any authenticated user, including a low-privileged subscriber, can point the proxy at an attacker-controlled host. Arbitrary content is then served from the victim site's own origin, enabling content spoofing, phishing, and downstream client-side attacks.
Critical Impact
Authenticated subscribers can hijack the plugin's front-end proxy and serve attacker-controlled content from the trusted WordPress origin, undermining confidentiality, integrity, and availability.
Affected Products
- Unbounce Landing Pages WordPress plugin versions prior to 1.1.5
- WordPress sites with the plugin installed and open user registration or existing low-privilege accounts
- Any origin serving proxied content through the plugin's front-end proxy configuration
Discovery Timeline
- 2026-09-19 - CVE-2026-85574 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-85574
Vulnerability Analysis
The Unbounce Landing Pages plugin exposes an endpoint that updates the configuration for its front-end proxy component. This configuration determines which upstream host the proxy fetches content from before returning it under the WordPress site's origin. The endpoint does not verify the caller's role or capabilities. Any authenticated session, including the default subscriber role, can submit a configuration update and redirect the proxy target.
Once the proxy is redirected, visitors requesting affected paths receive attacker-controlled HTML, JavaScript, or other assets delivered from the trusted domain. Because the content is served same-origin, it inherits cookies, session context, and any trust the browser assigns to the WordPress site. This enables convincing phishing pages, credential harvesting, arbitrary script execution against authenticated visitors, and site defacement. Full details are available in the WPScan Vulnerability Report.
Root Cause
The root cause is a missing authorization check [CWE-862] on the configuration update handler. The plugin verifies authentication but does not enforce a capability check such as current_user_can('manage_options') or a matching nonce tied to an administrator context.
Attack Vector
An attacker registers or logs in as any authenticated user, then issues a crafted request to the plugin's configuration update endpoint. The request sets the proxy upstream to a host under attacker control. Subsequent visitor requests to proxied paths are served attacker content from the victim origin. Exploitation requires only low privileges and user interaction on the delivery side.
Refer to the WPScan Vulnerability Report for endpoint specifics.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-85574
Indicators of Compromise
- Unexpected modifications to the Unbounce plugin's proxy configuration in the WordPress wp_options table or plugin-specific settings tables
- Outbound HTTP requests from the WordPress host to unfamiliar external domains referenced by the proxy configuration
- Visitor-facing pages returning content that does not match the site's authored landing pages
- Access log entries showing subscriber-level accounts issuing POST requests to plugin administrative endpoints
Detection Strategies
- Audit WordPress user activity for low-privilege accounts invoking plugin configuration endpoints
- Compare current plugin proxy settings against a known-good baseline and alert on drift
- Inspect served landing page responses for unexpected script sources, redirects, or third-party form actions
Monitoring Recommendations
- Enable WordPress audit logging for option changes and REST API calls made by non-administrator users
- Forward web server access logs and WordPress audit events to a centralized analytics platform for correlation
- Monitor egress traffic from WordPress hosts and alert on new upstream destinations contacted by PHP processes
How to Mitigate CVE-2026-85574
Immediate Actions Required
- Update the Unbounce Landing Pages plugin to version 1.1.5 or later on all WordPress installations
- Review the plugin's proxy configuration and reset it to a known-good upstream value
- Audit user accounts and remove or reset credentials for unrecognized subscriber-level users
- Rotate authenticated session tokens and review recent option changes for evidence of tampering
Patch Information
The vendor addressed CVE-2026-85574 in version 1.1.5 of the Unbounce Landing Pages plugin by adding an authorization check to the proxy configuration update handler. Administrators should apply this update through the WordPress plugin dashboard or by pulling the updated release from the WordPress plugin repository. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the Unbounce Landing Pages plugin until the patched version can be deployed
- Close open user registration or restrict the default new-user role away from any account tier that can reach the plugin's endpoints
- Place the WordPress admin and plugin REST endpoints behind IP allowlists or a web application firewall rule that blocks non-administrator sessions
# Configuration example
wp plugin update unbounce-landing-pages --version=1.1.5
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
