CVE-2026-12409: Landing Page Builder CSRF to Arbitrary Post Modification

Vulnerability Overview Vulnerability Name: Landing Page Builder <= 1.5.3.6 - Cross-Site Request Forgery to AJAX Action CVE ID: CVE-2026-12409 CVSS Score: 4.3 (Medium) Publication Date: July 15, 2026 Last Updated: July 16, 2026 Researcher: M.Fahad Khan Scope of Impact Software Type: Plugin Software Name: Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages Affected Versions: <= 1.5.3.6 Fixed Versions: 1.5.3.7 Remediation Remediation Measure: Update to version 1.5.3.7 or later patched versions. Vulnerability Description This vulnerability allows unauthenticated attackers to create, update, delete, restore, or change post status, slug, and arbitrary post content by forging requests to exploit the AJAX action. The flaw resides in the function due to missing or incorrect nonce verification. Attackers can trick administrators into performing arbitrary actions, such as clicking a link. This attack requires the victim to have an editor or administrator session, as the action enforces capability checks; therefore, forged requests must inherit the logged-in user's session cookie. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Recent Related Vulnerabilities: - CVE-2026-57337: Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages <= 1.5.3.5 - Unauthenticated Stored Cross-Site Scripting - CVE-2026-24620: Landing Page Builder <= 1.5.3.4 - Authenticated (Author+) Stored Cross-Site Scripting - CVE-2024-43345: Landing Page Builder <= 1.5.2.0 - Authenticated (Editor+) Local File Inclusion - CVE-2024-34752: Landing Page Builder <= 1.5.1.8 - Reflected Cross-Site Scripting via pageType - CVE-2024-30452: Landing Page Builder <= 1.5.1.7 - Authenticated (Editor+) Stored Cross-Site Scripting - CVE-2023-48325: Landing Page Builder <= 1.5.1.5 - Open Redirect - CVE-2023-40675: Landing Page Builder <= 1.5.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting - CVE-2022-4718: Landing Page Builder <= 1.4.9.8.9 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode - CVE-2021-25067: Landing Page Builder <= 1.4.9.5 - Reflected Cross-Site Scripting Summary This vulnerability is a Cross-Site Request Forgery (CSRF) issue affecting multiple versions of the Landing Page Builder plugin. Attackers can exploit this flaw to perform arbitrary actions. It is recommended that users update to version 1.5.3.7 or higher as soon as possible to remediate this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-12409: Landing Page Builder CSRF to Arbitrary Post Modification