Description

Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-08T08:17:12.630Z",
  "pubdate": "2026-09-08T08:17:12.630Z",
  "executiveSummary": "This vulnerability is classified as a Missing Authorization flaw within the Unbounce Landing Pages plugin for WordPress.\nThe vulnerability allows unauthorized actors to exploit incorrectly configured access control security levels, bypassing intended administrative restrictions.\nThe flaw affects all versions of Unbounce Landing Pages from n/a through 1.1.4.\nThe primary risk involves the unauthorized modification or access to landing page configurations and administrative settings, which could be leveraged to compromise site integrity or exfiltrate sensitive marketing data.\nExploitation does not inherently require high-level administrative credentials, as the vulnerability resides in the improper validation of user authorization requests.\nAttackers can leverage this vulnerability to gain unauthorized control over plugin functionality, potentially leading to unauthorized data exposure or malicious redirection of landing page traffic.\nThe vulnerability presents a significant risk to organizations relying on the plugin for campaign management, as it undermines the access control layer essential for maintaining the security of marketing assets.",
  "technicalDetails": "The core issue originates from a failure in the Unbounce Landing Pages plugin to adequately enforce authorization checks on sensitive administrative endpoints or functions.\nThe vulnerability occurs due to improper implementation of the WordPress capability check mechanism (e.g., current_user_can()) or the absence of nonces in sensitive requests, allowing unauthorized actors to perform actions that should be restricted to privileged roles.\nBy failing to verify the authorization level of the requester before processing the request, the plugin allows an attacker to interact with the plugin’s backend logic directly.\nThe attack flow typically involves an attacker crafting HTTP requests—specifically GET or POST requests directed at plugin-specific API endpoints or administrative handlers—without the necessary authentication tokens or elevated user privileges.\nBecause the server-side logic fails to validate the user's role against the required capability set, the plugin executes the requested functionality as if the user were authorized.\nThe vulnerable component involves the internal routing and request handling mechanisms within the plugin that process administrative commands related to page configuration, API key settings, or metadata management.\nThis vulnerability impacts all versions from n/a through 1.1.4, indicating a systemic flaw in how access control is architected within the plugin's code base.\nExploitation is feasible over a network via standard HTTP communication channels, as the missing authorization permits unauthorized access to functions intended for administrative management.\nPost-exploitation, an attacker can manipulate landing page parameters, alter tracking configurations, or potentially disrupt the service by changing API integration credentials, leading to data loss or redirection of user traffic to external, malicious infrastructure.\nThe lack of proper session-based or role-based authorization validation effectively bypasses the security layer that should protect plugin configuration from unauthorized external interference."
}