WordPress Unbounce Landing Pages plugin has broken access control flaw

🕵️ RESEARCH & DEEP DIVES

• WordPress Unbounce Landing Pages plugin through 1.1.4 has broken access control flaw (CVE-2026-81781)
  A missing authorization vulnerability (CVE-2026-81781) was disclosed in the Unbounce Landing Pages WordPress plugin affecting all versions through 1.1.4.

  • Affects WordPress sites running the Unbounce Landing Pages plugin (unbounce), all versions from n/a through 1.1.4
  • CWE-862 Missing Authorization (broken access control) allowing exploitation of incorrectly configured access control security levels
  • CVSS 3.1 score 7.1 High: network vector, low attack complexity, low privileges required, no user interaction (C:N/I:L/A:H)
  • Reported by HieuPenguinnn via the Patchstack Bug Bounty Program; assigned by Patchstack, published 2026-09-08
  Sources 📄 Source: cve.threatint.com · 📎 Coverage: radar.offseq.com · 👁 via CVE ThreatInt

• Shai-Hulud npm Worm Resurfaces After 111 Days and Slips Past Malware Scanning
  The Shai-Hulud npm worm has resurfaced after 111 days of dormancy in newly published packages that evade malware scanning.

  • Applies to JavaScript/npm developers, whose environments the worm targets through seemingly ordinary software packages.
  • The worm returned after more than three months of silence carrying the same malicious file linked to an earlier npm supply-chain incident.
  • Four malicious packages were uploaded within a single hour.
  • Republishing the known threat inside ordinary-looking packages lets it evade malware scanning and regain access to developer environments.
  Sources 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• 220 million traveler records exposed in Vietnam-linked APIS leak — BleepingComputer

• Grindr to Pay £26 Million to Settle U.K. Claims Over HIV Status Data Sharing — The Hacker News

• XXE Vulnerability in Cosminexus Component ContainerImproper restriction of XM... — CVE ThreatInt

• Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitize... — CVE ThreatInt

• Deserialization of Untrusted Data Vulnerability in Cosminexus Component Conta... — CVE ThreatInt

• WordPress Hide My WP Ghost plugin through 7.0.09 - Server Side Request Forgery (SS... — CVE ThreatInt

• WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin before 4.2.8 - ... — CVE ThreatInt

• WordPress Easy Appointments plugin through 4.0.2.1 - Cross Site Scripting (XSS) vu... — CVE ThreatInt

• WordPress Open User Map plugin through 1.4.50 - Cross Site Scripting (XSS) vulnera... — CVE ThreatInt

• WordPress Product Catalog Enquiry for WooCommerce by MultiVendorX plugin through 6... — CVE ThreatInt

• AI Customer Service Bots Can Be Tricked Into Stealing Security Codes and Acting as Victims — Cyber Security News

• BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft — Cyber Security News

• Top 10 Best Extended Detection & Response (XDR) Platforms in 2026 — Cyber Security News

• Top 10 Best Firewall-as-a-Service (FWaaS) Providers in 2026 — Cyber Security News

• Top 10 Best Web Application Firewall (WAF) Solutions in 2026 — Cyber Security News

• Hackers Hijack Coder Registry to Push Malicious Terraform Modules and Steal Cloud Credentials — Cyber Security News

• ShinyHunters Gained Access to 6 Million Customers’ Records Using a Single Call — Cyber Security News

• Chatbot leaked a planted phone number and failed 58% of prompt injection attempts - jailbreak and extraction checks stayed clean — r/netsec

• RMM Phishing Campaign Spans 46 Countries as Attackers Abuse Trusted IT Tools — r/cybersecurity

📋 ADVISORIES

• 📄 Source for WordPress WpEvently plugin <= 5.6.0 vulnerable to unauthenticated IDOR (CVE-2026-81802) — patchstack.com