CVE-2026-12409 umarbajwa CVE debrief

Who should care

Users of the Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin for WordPress should apply updates to prevent Cross-Site Request Forgery attacks. This includes administrators, security teams, and operators who manage WordPress installations with this plugin.

Technical summary

The vulnerability allows unauthenticated attackers to create, update, retitle, or change the post status, slug, and type of arbitrary posts and write ULPB_DATA post meta via a forged request. This requires the victim to hold an editor-level or administrator session. The wp_ajax_ulpb_admin_data action enforces a capability check that the forged request must satisfy by inheriting the logged-in user's session cookies. The vulnerability is due to missing or incorrect nonce validation on the ulpb_admin_ajax function.

Defensive priority

Medium priority due to the CVSS score of 4.3 and the potential for unauthorized post modifications.

Recommended defensive actions

• Apply the latest updates to the Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin.
• Review and adjust the plugin's nonce validation for the ulpb_admin_ajax function.
• Monitor for suspicious activity related to post modifications and ULPB_DATA post meta changes.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence from the NVD and Wordfence indicates a Cross-Site Request Forgery vulnerability in the Landing Page Builder plugin. The CVE record and NVD detail provide additional context. The vulnerability allows unauthenticated attackers to create, update, retitle, or change the post status, slug, and type of arbitrary posts and write ULPB_DATA post meta via a forged request. This requires the victim to hold an editor-level or administrator session. The wp_ajax_ulpb_admin_data action enforces a capability check that the forged request must satisfy by inheriting the logged-in user's session cookies.

Official resources