CVE-2026-22490: 
WordPress vulnerability analysis and mitigation

CVE-2026-22490 is a Missing Authorization vulnerability in the Bulk Landing Page Creator for WordPress LPagery plugin (by niklaslindemann) that allows authenticated low-privileged attackers to exploit incorrectly configured access control security levels. The vulnerability affects all plugin versions from n/a through 2.4.9 (inclusive). It was published on January 8, 2026, and assigned by Patchstack. The CVSS v3.1 base score is 5.4 (Medium) (Patchstack).

The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether an authenticated user has the appropriate permissions before allowing access to sensitive functionality. An attacker with a low-privileged WordPress account (e.g., Subscriber or Contributor role) can send crafted network requests to plugin endpoints that lack proper capability checks, enabling them to modify or disable landing pages managed by the plugin. No user interaction is required, and attack complexity is low, making this straightforward to exploit for any authenticated user (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to modify or disable landing pages created with the LPagery plugin, resulting in limited integrity and availability impacts. Confidentiality is not directly affected, as no sensitive data is exposed. The primary business risk is disruption or defacement of marketing landing pages, which could impact lead generation or campaign performance for affected WordPress sites (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-22490. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid (low-privileged) WordPress account on the target site, limiting the attacker pool compared to unauthenticated vulnerabilities (Patchstack).

1. Reconnaissance: Identify WordPress sites running the LPagery plugin (version ≤ 2.4.9) using tools like WPScan or by checking /wp-content/plugins/lpagery/ for plugin presence.
2. Obtain low-privileged access: Register or use an existing low-privileged WordPress account (e.g., Subscriber role) on the target site.
3. Identify unprotected endpoints: Enumerate plugin AJAX actions or REST API endpoints registered by LPagery that lack proper current_user_can() capability checks.
4. Craft malicious request: Send an authenticated HTTP POST request (with valid WordPress nonce/cookie) to the vulnerable endpoint, supplying parameters to modify or disable target landing pages.
5. Achieve objective: Landing pages are altered or taken offline, disrupting the site's marketing or lead-generation functionality (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to LPagery plugin AJAX endpoints (e.g., wp-admin/admin-ajax.php with LPagery-specific action parameters) from low-privileged user accounts.
• Logs: WordPress audit logs (if enabled) recording unexpected modifications or status changes to landing pages by non-administrative users.
• File System: Unexpected changes to landing page post metadata or post status in the WordPress database (wp_posts, wp_postmeta tables) attributed to low-privileged user IDs.
• Network: Repeated authenticated requests to plugin endpoints from the same user account in a short time window, suggesting automated exploitation.

Update the LPagery plugin to version 2.4.10 or later, which contains the fix for this missing authorization issue. Site administrators should log in to the WordPress admin dashboard, navigate to Plugins > Installed Plugins, and update LPagery immediately. As a temporary workaround, consider deactivating the plugin until the update can be applied, or restricting new user registrations to limit the attacker pool (Patchstack).