CVE-2026-79632: WPFunnels plugin unauthenticated arbitrary email sending in opt-in handler

CVE-2026-79632 · Severity: medium · CVSS 5.3 · Published 2026-09-04

The WPFunnels WordPress plugin is used to build marketing funnels and email opt-in forms. A vulnerability allows unauthenticated attackers to send emails to arbitrary recipients with arbitrary subject lines and content by manipulating the opt-in submission handler, bypassing all authorization and security checks. This enables attackers to use a compromised website as a spam relay for phishing or malicious campaigns, damaging the website's reputation and email deliverability.

Technologies: WPFunnels. Vendors: WPFunnels.

Quick answers

Is CVE-2026-79632 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-79632 being exploited in the wild.
How severe is CVE-2026-79632?
Medium severity, with a CVSS score of 5.3, published 4 September 2026.
Which products and versions are affected?
WPFunnels before 3.13.0.
Is there a fix for CVE-2026-79632?
A patch was published on 2026-09-02: Fixed in version 3.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79632 attacked?
It is attacked over the network.
Am I affected by CVE-2026-79632?
Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control flaw (CWE-862) in the wpfnl_shortcode_optin_submission AJAX handler. The plugin fails to perform authorization checks, nonce validation, or CSRF protection on email submission requests. An unauthenticated attacker can send a POST request to wp-admin/admin-ajax.php with the action parameter set to wpfnl_shortcode_optin_submission and inject arbitrary recipient email addresses (comma-separated), subject lines, and message body content via request parameters (admin_email, admin_email_subject, postData). The plugin processes these values without validation, directly interpolating attacker-supplied content into email templates and sending them from the site's own email address. The vulnerability requires no special configuration, active funnels, or opt-in forms to exploit, and the plugin's reCAPTCHA check can be bypassed by omitting its configuration flag. WPFunnels 3.13.0 and later include the fix; all earlier versions are affected.

Affected products

  • WPFunnels WPFunnels before 3.13.0

Timeline

  • 2026-09-02: disclosed
  • 2026-09-04: other: CVE-2026-79632 published
  • 2026-09-02: patched: Fixed in version 3.13.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.