The vulnerability CVE-2026-12409 affects the 'Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages' plugin for WordPress in all versions up to and including 1.5.3.6. It is a Cross-Site Request Forgery (CSRF) issue caused by missing or incorrect nonce validation on the ulpb_admin_ajax function. This flaw allows unauthenticated attackers to perform actions such as creating, updating, retitling, or changing the post status, slug, and type of arbitrary posts, as well as modifying ULPB_DATA post meta. Exploitation requires the victim to have an active editor or administrator session and to be tricked into clicking a crafted link, as the action enforces capability checks based on the logged-in user's session cookies.

An attacker can leverage this CSRF vulnerability to modify content and metadata of posts within the affected WordPress site without direct authentication, provided they can trick an editor or administrator into performing an action. This can lead to unauthorized content changes, potentially impacting site integrity and trustworthiness. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators and editors should be cautious about clicking on untrusted links while logged into the WordPress admin interface. Monitoring for updates from the plugin vendor or WordPress security channels is recommended to apply any official fixes once released.