PT-2026-60397 · WordPress · Landing Page Builder

M.Fahad Khan · Published 2026-07-16 · Updated 2026-07-16 · CVE-2026-12409

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages versions prior to 1.5.3.7

Description Cross-Site Request Forgery occurs due to missing or incorrect nonce validation in the ulpb admin ajax() function. This allows unauthenticated attackers to create, update, retitle, or change the post status, slug, and type of arbitrary posts, as well as write ULPB DATA post meta through a forged request. The attack requires a victim with editor-level or administrator privileges to perform an action, such as clicking a link, because the wp ajax ulpb admin data action requires a capability check satisfied by the logged-in user's session cookies.

Recommendations Update to version 1.5.3.7 or later.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-12409

Affected Products

Landing Page Builder

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-12409 · Security Note
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3444409%40page-builder-add&new=3444409%40page-builder-add · Note
• https://plugins.trac.wordpress.org/browser/page-builder-add/tags/1.5.3.5/admin/classes/ajax-requests-class.php#L19 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a2b2dd36-eca8-4d80-80f5-783f9402dd3c?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2077644168130617433 · Twitter Post
• https://plugins.trac.wordpress.org/browser/page-builder-add/tags/1.5.3.5/admin/classes/ajax-requests-class.php#L111 · Note
• https://plugins.trac.wordpress.org/browser/page-builder-add/tags/1.5.3.6/admin/classes/ajax-requests-class.php#L19 · Note
• https://plugins.trac.wordpress.org/browser/page-builder-add/tags/1.5.3.6/admin/classes/ajax-requests-class.php#L111 · Note