CVE-2026-12409
Received Received - Intake

Cross-Site Request Forgery in Landing Page Builder WordPress Plugin

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: Wordfence

Description
The Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.3.6. This is due to missing or incorrect nonce validation on the ulpb_admin_ajax function. This makes it possible for unauthenticated attackers to create, update, retitle, or change the post status, slug, and type of arbitrary posts and write ULPB_DATA post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This attack requires the victim to hold an editor-level or administrator session, as the wp_ajax_ulpb_admin_data action enforces a capability check that the forged request must satisfy by inheriting the logged-in user's session cookies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-12409
EUVD
EUVD-2026-44858

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpbeaverbuilder landing_page_builder to 1.5.3.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Landing Page Builder WordPress plugin. It affects versions up to 1.5.3.6 due to missing nonce validation on the ulpb_admin_ajax function. Attackers can trick administrators into performing actions like clicking a link, allowing them to create, update, or modify posts and metadata without proper authorization.

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Landing Page Builder plugin for WordPress. It affects versions up to 1.5.3.6 due to missing or incorrect nonce validation on the ulpb_admin_ajax function. Attackers can trick administrators into performing actions like clicking a link, allowing them to create, update, or modify posts and post meta without proper authorization.

Impact Analysis

An attacker could exploit this to change your website's content, such as altering posts, modifying page statuses, or updating settings without your knowledge. This requires tricking an administrator into clicking a malicious link while logged in.

Detection Guidance

This vulnerability can be detected by checking for unauthorized changes to posts or settings in WordPress. Look for unexpected modifications to pages, posts, or metadata. Review server logs for suspicious AJAX requests to the ulpb_admin_ajax function. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to change your website's content, such as altering posts or pages, without your knowledge. This could lead to defacement, spreading malware, or manipulating site visitors. The attack requires tricking an admin into clicking a malicious link while logged in.

Compliance Impact

This vulnerability could lead to unauthorized content changes, potentially violating data integrity requirements in GDPR or HIPAA. If exploited, it may result in unauthorized modifications to sensitive data, triggering compliance violations depending on the affected content.

Mitigation Strategies

Update the Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin to the latest version beyond 1.5.3.6 to address the missing nonce validation issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12409. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart