Junglewise Threat Intelligence

CVE-2026-12409: WordPress Landing Page Builder CSRF in ulpb_admin_ajax

CVE-2026-12409 · Severity: medium · CVSS 4.3 · Published 2026-07-16

Executive brief

A vulnerability in the Landing Page Builder plugin for WordPress allows attackers to trick a site administrator into unintentionally modifying website content. By convincing an editor or administrator to click a malicious link, an attacker can create, update, or delete posts and change page settings. This could lead to unauthorized content changes or website defacement, potentially damaging a company's reputation or misleading site visitors.

Technical details

The Landing Page Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the 'ulpb_admin_ajax' function. This flaw allows unauthenticated attackers to perform administrative actions such as creating, updating, or retitling posts, and modifying post status, slugs, or 'ULPB_DATA' post meta. The attack is executed by tricking a logged-in user with editor or administrator privileges into clicking a malicious link or submitting a forged request. Because the 'wp_ajax_ulpb_admin_data' action performs a capability check but lacks CSRF protection, the forged request succeeds by inheriting the victim's active session cookies. The vulnerability is present in all versions up to and including 1.5.3.6.

Affected products

  • umarbajwa Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages up to, and including, 1.5.3.6

Timeline

  • 2026-07-16: disclosed
  • 2026-07-16: advisory

References