WordPress Plugin Vulnerabilities

Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

Description

The plugin does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

Proof of Concept

Affects Plugins

Plugin icon
unbounce
Fixed in 1.1.5

References

CVE
CVE-2026-85574

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
8.0 (high)

Miscellaneous

Original Researcher
Furkan Arslan
Submitter
Furkan Arslan
Verified
Yes
WPVDB ID
f13143dc-5674-4e9f-8aa0-8d22df7a7379

Timeline

Publicly Published
2026-09-17 (about 2 days ago)
Added
2026-09-17 (about 1 day ago)
Last Updated
2026-09-18 (about 8 hours ago)

Other

Published
Title
Published
2024-06-07
Title
Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings Update
Published
2025-01-31
Title
AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations <= 1.4.23 - Missing Authorization to Unauthenticated Settings Update
Published
2025-08-26
Title
All Bootstrap Blocks < 1.3.29 - Missing Authorization
Published
2024-04-22
Title
VK Block Patterns < 1.31.1.1 - Missing Authorization
Published
2026-08-10
Title
E-cab Taxi Booking Manager for Woocommerce < 2.0.5 - Missing Authorization