CVE-2026-12409
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Landing Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.5.3.6. Missing nonce validation in the ulpb_admin_ajax function allows unauthenticated attackers to perform unauthorized actions on posts and post meta.
Risk Assessment
An attacker can trick an administrator or editor into clicking a crafted link, enabling creation, modification, or status changes of arbitrary posts and writing ULPB_DATA post meta. This could lead to site defacement or injection of malicious content.
Recommendation
Immediately update the Landing Page Builder plugin to the latest available version. If no update is available, temporarily disable the plugin until a patch is released.
Related vulnerabilities
- CVE-2026-109694Critical
The Fluent CRM plugin (up to 3.2.5) contains an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker could exploit this flaw to gain higher privileges within the WordPress system.
- CVE-2026-108497Critical
The Amelia Booking plugin (up to 2.4.10) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. An attacker could execute arbitrary SQL queries, potentially leading to data leakage or modification.
- CVE-2026-50619Critical
A path traversal vulnerability has been reported in Qsirch, which could allow remote attackers to read unexpected files or system data. The vulnerability has been fixed in version 7.0.3.0 and later.
- CVE-2026-50612Critical
A Unix symbolic link (symlink) following vulnerability has been reported in QuMagie. If a remote attacker gains a user account, they can exploit the vulnerability to compromise the security of the system. The vulnerability has been fixed in version 2.9.2 and later.
- CVE-2026-47786Critical
An OS command injection vulnerability has been reported in HybridDesk Station, which could allow remote attackers to execute arbitrary commands. The vulnerability has been fixed in versions 4.2.23 and 4.3.4 and later.
- CVE-2026-34006Critical
A missing authentication for critical function vulnerability has been reported in sMedio DTCP MOVE, which could allow remote attackers to gain access to the system. The vulnerability has been fixed in version 1.4.5 and later.
- CVE-2026-19863Critical
In EthereumAuthenticator, an unauthenticated client may access certain protected resources if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page, which may replace authentication or role requirements with ALLOWED.
- CVE-2026-16438Critical
Mitsubishi Electric products (GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, MC Works64) versions 10.97.3 and prior contain an incorrect privilege assignment vulnerability. Installers grant default DCOM permissions to the administrator account, allowing an attacker to locally or remotely launch and operate DCOM objects that should require UAC elevation.
- CVE-2026-16436Critical
Mitsubishi Electric products (GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, BizViz) contain a weak password recovery mechanism for forgotten passwords. The challenge response used to unlock the system is common to all users and fixed, allowing a remote attacker to unlock the system after obtaining it.
- CVE-2026-102469Critical
The Vert.x DB2 client (vertx-db2-client) deserializes User Defined Type (UDT) column data using a bare ObjectInputStream.readObject() call without an ObjectInputFilter or class allowlist. A malicious or man-in-the-middle DRDA server can send a response with a column tagged as UDT (FDOCA LID 0x50), causing deserialization of attacker-controlled bytes. TLS is disabled by default, making man-in-the-middle exploitation feasible.
Original NVD description (English source)
The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpb_admin_ajax function. This makes it possible for unauthenticated attackers to create, update, retitle, or change the post status, slug, and type of arbitrary posts and write ULPB_DATA post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This attack requires the victim to hold an editor-level or administrator session, as the wp_ajax_ulpb_admin_data action enforces a capability check that the forged request must satisfy by inheriting the logged-in user's session cookies.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS