PT-2025-49343 · WordPress · Wp Landing Page

Ivan Cese · Published 2025-12-06 · Updated 2025-12-06 · CVE-2025-13629

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Landing Page plugin for WordPress versions up to and including 0.9.3

Description The WP Landing Page plugin for WordPress is susceptible to Cross-Site Request Forgery, allowing unauthenticated attackers to update arbitrary post meta via a forged request. This is possible due to missing nonce validation on the wplp api update text function. An attacker could trick a site administrator into performing an action, such as clicking a link, to execute the malicious request.

Recommendations Update the WP Landing Page plugin to a version later than 0.9.3.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-13629

Affected Products

Wp Landing Page

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13629 · Security Note
• https://plugins.trac.wordpress.org/browser/wp-landing-page/tags/0.9.3/includes/wplp-api.php#L14 · Note
• https://plugins.trac.wordpress.org/browser/wp-landing-page/trunk/includes/wplp-api.php#L14 · Note
• https://twitter.com/CVEnew/status/1997189883387842980 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1997227650524291265 · Twitter Post
• https://t.me/CVEtracker/38986 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/43d8576b-e6ad-4e0a-b99f-948ba36f53ff?source=cve · Note