Quick answers
- Is CVE-2025-15691 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-15691 being exploited in the wild.
- How severe is CVE-2025-15691?
- Medium severity, with a CVSS score of 5.3, published 4 September 2026.
- Which products and versions are affected?
- WPFunnels before 3.13.0.
- Is there a fix for CVE-2025-15691?
- A patch was published on 2026-09-04: Fixed in version 3.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-15691 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-15691?
- Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an incomplete authorization bypass (CWE-863) in user account creation logic. The plugin does not verify the site's "Anyone can register" setting before creating accounts via opt-in form submissions; instead, it relies on a client-supplied "optin_allow_registration" parameter. This is a partial fix for CVE-2025-12353, which only patched one of three registration code paths (the shortcode handler). Two additional paths remain vulnerable: the Gutenberg opt-in form handler (wpfnl_gutenberg_optin_submission) and the Elementor opt-in form handler (wpfnl_optin_submission). An unauthenticated attacker can craft a POST request to wp-admin/admin-ajax.php with a nonce harvested from the public funnel page and provide arbitrary email, username, and other account details to create a functioning WordPress user account. Patch version 3.13.0 addresses all three registration paths.
Affected products
- WPFunnels WPFunnels before 3.13.0
Timeline
- 2026-09-02: disclosed
- 2026-09-04: patched: Fixed in version 3.13.0