Unbounce Plugin Allows Unauthorized Proxy Reconfiguration

The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on, allowing any authenticated user, such as a subscriber, to point that proxy at a host they control and have arbitrary content served from the site's own origin.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Unbounce Landing Pages WordPress plugin before version 1.1.5 contains an authorization bypass vulnerability (CWE-862) that allows any authenticated user—including low-privilege subscribers—to reconfigure the front-end proxy settings. By pointing this proxy toward an attacker-controlled host, threat actors can serve malicious content from the legitimate site's origin, enabling credential harvesting, malware distribution, and phishing attacks that appear to come directly from a trusted domain. This affects WordPress sites using the vulnerable plugin versions, with particularly high risk for multi-user environments where subscriber accounts are readily available.

Casky's security skills detect the attack patterns mapped to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access) by identifying suspicious proxy configuration changes originating from low-privilege accounts, unexpected redirects to external hosts, and content delivery mismatches between the WordPress domain and actual source origins. Practitioners using Casky's 283 matched skills would see findings highlighting unauthorized modification of proxy settings, unusual authentication patterns for configuration endpoints, and indicators of content injection—enabling defenders to spot exploitation attempts before malicious content is served or credentials are compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-85574.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-85574

Casky has 283 skills that investigate the attack patterns behind CVE-2026-85574. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn