Executive brief
The WPFunnels WordPress plugin is used to build marketing funnels and email opt-in forms. A vulnerability allows unauthenticated attackers to send emails to arbitrary recipients with arbitrary subject lines and content by manipulating the opt-in submission handler, bypassing all authorization and security checks. This enables attackers to use a compromised website as a spam relay for phishing or malicious campaigns, damaging the website's reputation and email deliverability.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in the wpfnl_shortcode_optin_submission AJAX handler. The plugin fails to perform authorization checks, nonce validation, or CSRF protection on email submission requests. An unauthenticated attacker can send a POST request to wp-admin/admin-ajax.php with the action parameter set to wpfnl_shortcode_optin_submission and inject arbitrary recipient email addresses (comma-separated), subject lines, and message body content via request parameters (admin_email, admin_email_subject, postData). The plugin processes these values without validation, directly interpolating attacker-supplied content into email templates and sending them from the site's own email address. The vulnerability requires no special configuration, active funnels, or opt-in forms to exploit, and the plugin's reCAPTCHA check can be bypassed by omitting its configuration flag. WPFunnels 3.13.0 and later include the fix; all earlier versions are affected.
Affected products
- WPFunnels WPFunnels before 3.13.0
Timeline
- 2026-09-02: disclosed
- 2026-09-04: other: CVE-2026-79632 published
- 2026-09-02: patched: Fixed in version 3.13.0