Executive brief
WPFunnels is a popular WordPress plugin that helps marketers create sales funnels and opt-in forms. The plugin fails to properly validate whether user registration is enabled on a WordPress site before creating new user accounts from opt-in form submissions. This allows attackers to create new user accounts on any WordPress site running WPFunnels, even when administrators have explicitly disabled user registration in site settings.
Technical details
The vulnerability is an incomplete authorization bypass (CWE-863) in user account creation logic. The plugin does not verify the site's "Anyone can register" setting before creating accounts via opt-in form submissions; instead, it relies on a client-supplied "optin_allow_registration" parameter. This is a partial fix for CVE-2025-12353, which only patched one of three registration code paths (the shortcode handler). Two additional paths remain vulnerable: the Gutenberg opt-in form handler (wpfnl_gutenberg_optin_submission) and the Elementor opt-in form handler (wpfnl_optin_submission). An unauthenticated attacker can craft a POST request to wp-admin/admin-ajax.php with a nonce harvested from the public funnel page and provide arbitrary email, username, and other account details to create a functioning WordPress user account. Patch version 3.13.0 addresses all three registration paths.
Affected products
- WPFunnels WPFunnels before 3.13.0
Timeline
- 2026-09-02: disclosed
- 2026-09-04: patched: Fixed in version 3.13.0