Description

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-09-19T07:16:32.860Z",
  "pubdate": "2026-09-19T07:16:32.860Z",
  "executiveSummary": "The Unbounce Landing Pages WordPress plugin, in versions prior to 1.1.5, contains a critical Broken Access Control vulnerability. The flaw resides in the plugin's configuration management logic, which fails to perform necessary authorization checks when updating settings for its front-end proxy functionality.\nThis vulnerability allows any authenticated user, regardless of their privilege level—including those with minimal 'subscriber' access—to modify the proxy's target destination. By manipulating these settings, an attacker can redirect the plugin's proxy to an arbitrary remote host controlled by the attacker. Consequently, the affected WordPress site will serve malicious or unauthorized content from its own legitimate origin.\nThe risk implication is severe, as it facilitates sophisticated phishing, cross-site scripting (XSS) attacks, and unauthorized data harvesting by leveraging the trusted domain of the vulnerable site. Exploitation requires only a valid user account on the WordPress installation and does not necessitate administrative privileges. The vulnerability represents a significant breach of site integrity and security trust, as the application becomes a conduit for delivering attacker-supplied content under the guise of the site's original host context.",
  "technicalDetails": "The root cause of this vulnerability is an improper access control implementation within the Unbounce Landing Pages plugin's configuration update mechanism. In affected versions (pre-1.1.5), the plugin exposes an administrative functionality intended to manage the configuration of its front-end proxy without enforcing server-side authorization checks. Specifically, the software fails to validate the user's capability or role before processing requests to modify sensitive proxy parameters.\nThe attack flow begins with an attacker obtaining a valid authenticated session on the WordPress site. Due to the lack of access control checks, the attacker can submit a crafted request to the endpoint responsible for saving the proxy configuration. By injecting a malicious destination URL into the configuration parameters, the attacker instructs the plugin's proxy component to fetch and serve content from an external server rather than the intended legitimate source.\nOnce the configuration is successfully altered, any user or automated system interacting with the proxy component will trigger a request to the attacker-controlled server. The server then retrieves the remote content and presents it to the victim as if it originated from the compromised WordPress domain. Because the content is served from the trusted site's origin, this bypasses same-origin policy (SOP) restrictions, allowing for the execution of unauthorized scripts, the stealing of session cookies, or the presentation of deceptive content to users.\nThe vulnerable component is the configuration handler logic governing the proxy settings. This handler fails to invoke standard WordPress permission checks, such as 'current_user_can()', which would typically prevent unauthorized users from modifying plugin options. Because the plugin processes these requests globally for all authenticated users, the privilege requirements are minimal, requiring only the lowest tier of authenticated access.\nPost-exploitation impact includes the potential for full-scale defacement, credential harvesting through malicious login forms presented on the proxied pages, and the distribution of malware. By manipulating the origin, the attacker effectively subverts the site's security posture, rendering security headers or browser-based protections ineffective against the proxied content. This attack vector demonstrates how a seemingly minor configuration error in a plugin can lead to significant compromise of the entire web application's trust model."
}