CVE-2026-85574

9th percentile - higher than 9% of all known CVEs

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

An attacker can replace content served by the site, potentially leading to phishing, malware distribution, or loss of user trust.

Update the plugin to version 1.1.5 or later. Restrict user permissions and monitor proxy configuration for unauthorized changes.