# CVE-2025-15691: WPFunnels WordPress plugin unauthenticated user registration bypass

Source: https://junglewise.ai/threats/cve-2025-15691-wpfunnels-wordpress-plugin-unauthenticated-user-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2025-15691 · Severity: medium · CVSS 5.3 · Published 2026-09-04

WPFunnels is a popular WordPress plugin that helps marketers create sales funnels and opt-in forms. The plugin fails to properly validate whether user registration is enabled on a WordPress site before creating new user accounts from opt-in form submissions. This allows attackers to create new user accounts on any WordPress site running WPFunnels, even when administrators have explicitly disabled user registration in site settings.

Technologies: [WPFunnels](https://junglewise.ai/threats/technologies/wpfunnels). Vendors: [WPFunnels](https://junglewise.ai/threats/vendors/wpfunnels).

## Quick answers

**Is CVE-2025-15691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-15691 being exploited in the wild.

**How severe is CVE-2025-15691?** Medium severity, with a CVSS score of 5.3, published 4 September 2026.

**Which products and versions are affected?** WPFunnels before 3.13.0.

**Is there a fix for CVE-2025-15691?** A patch was published on 2026-09-04: Fixed in version 3.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-15691 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-15691?** Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an incomplete authorization bypass (CWE-863) in user account creation logic. The plugin does not verify the site's "Anyone can register" setting before creating accounts via opt-in form submissions; instead, it relies on a client-supplied "optin_allow_registration" parameter. This is a partial fix for CVE-2025-12353, which only patched one of three registration code paths (the shortcode handler). Two additional paths remain vulnerable: the Gutenberg opt-in form handler (wpfnl_gutenberg_optin_submission) and the Elementor opt-in form handler (wpfnl_optin_submission). An unauthenticated attacker can craft a POST request to wp-admin/admin-ajax.php with a nonce harvested from the public funnel page and provide arbitrary email, username, and other account details to create a functioning WordPress user account. Patch version 3.13.0 addresses all three registration paths.

## Affected products

- WPFunnels WPFunnels before 3.13.0

## Timeline

- 2026-09-02: disclosed
- 2026-09-04: patched: Fixed in version 3.13.0

## References

- [https://wpscan.com/vulnerability/c01926e9-f3e0-4bd5-9802-8f5f79a50504/](https://wpscan.com/vulnerability/c01926e9-f3e0-4bd5-9802-8f5f79a50504/)

## Related threats

- [WPFunnels missing authorization in AJAX payment handler](https://junglewise.ai/threats/cve-2026-84908-wpfunnels-missing-authorization-in-ajax-payment-handler)
- [WPFunnels plugin unauthenticated arbitrary email sending in opt-in handler](https://junglewise.ai/threats/cve-2026-79632-wpfunnels-plugin-unauthenticated-arbitrary-email-sending-in-opt)
- [WPFunnels WordPress plugin information disclosure via web-accessible logs](https://junglewise.ai/threats/cve-2026-79631-wpfunnels-wordpress-plugin-information-disclosure-via-web)
- [WPFunnels checkout order bump product substitution allowing price manipulation](https://junglewise.ai/threats/cve-2026-79630-wpfunnels-checkout-order-bump-product-substitution-allowing-price)
- [WPFunnels broken access control vulnerability](https://junglewise.ai/threats/cve-2026-84754-wpfunnels-broken-access-control-vulnerability)