Landing Page Builder WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Landing Page Builder WordPress plugin, specifically in versions through 1.5.3.6. The issue arises from inadequate nonce validation in the 'ulpb_admin_ajax' function, allowing unauthenticated attackers to manipulate posts and associated metadata. Exploitation requires tricking an administrator or editor into clicking a link, as the attack must leverage the victim's session cookies to bypass capability checks.

Impact

Exploitation of this vulnerability could lead to unauthorized changes to posts, including modifications to titles, statuses, slugs, types, and associated ULPB_DATA post metadata.

Remediation

Users are advised to update the plugin to version 1.5.3.7 or a later patched version.