CVE-2026-85574 - Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains · CoreCVE

Back Back to CVE browser

HIGH

Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

Published Sep 19, 2026

8.0

HIGH

CVSS 3.1

EPSS 0.34%

Description

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

Affected products

Vendor n/a Product Unbounce Landing Pages Default
unaffected
- Version
  1.1.1
  Status
  affected
  Constraints
  <1.1.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Unbounce Landing Pages

unaffected

Version	Status	Constraints
1.1.1	affected	<1.1.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (1)

https://wpscan.com/vulnerability/f13143dc-5674-4e9f-8aa0-8d22df7a7379/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://wpscan.com/vulnerability/f13143dc-5674-4e9f-8aa0-8d22df7a7379/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 19, 2026

Updated Sep 19, 2026

Reserved Sep 4, 2026

Link CVE-2026-85574

CISA Vulnrichment

Updated Sep 19, 2026

Status Received

Modified Sep 19, 2026

Link CVE-2026-85574

Severity n/a

Public date n/a

Links CVE-2026-85574