CVE-2026-12409 is a CSRF vulnerability in the Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages plugin. The issue stems from missing or incorrect nonce validation on the ulpb_admin_ajax function, specifically the wp_ajax_ulpb_admin_data action. This allows an attacker to craft a forged request that, when executed by an authenticated user with editor or administrator privileges, can create, update, retitle, or change the post status, slug, type of arbitrary posts, and write ULPB_DATA post meta. The attack leverages the victim's session cookies and requires user interaction (UI:R). The vulnerability affects all plugin versions up to and including 1.5.3.6.

An attacker can exploit this vulnerability to manipulate posts and their metadata on a WordPress site by tricking an editor or administrator into performing an action such as clicking a malicious link. This can lead to unauthorized changes in content and post attributes. There is no direct confidentiality or availability impact reported. The attack requires the victim to be logged in with sufficient privileges, limiting the scope to users with editor or administrator roles.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, administrators should monitor the vendor's communications for updates. Until a fix is available, limit editor and administrator access to trusted users and educate them about the risks of clicking untrusted links. Implementing additional CSRF protections or nonce validations in the plugin code can mitigate the risk if custom development resources are available.