# CVE-2026-79632: WPFunnels plugin unauthenticated arbitrary email sending in opt-in handler

Source: https://junglewise.ai/threats/cve-2026-79632-wpfunnels-plugin-unauthenticated-arbitrary-email-sending-in-opt  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79632 · Severity: medium · CVSS 5.3 · Published 2026-09-04

The WPFunnels WordPress plugin is used to build marketing funnels and email opt-in forms. A vulnerability allows unauthenticated attackers to send emails to arbitrary recipients with arbitrary subject lines and content by manipulating the opt-in submission handler, bypassing all authorization and security checks. This enables attackers to use a compromised website as a spam relay for phishing or malicious campaigns, damaging the website's reputation and email deliverability.

Technologies: [WPFunnels](https://junglewise.ai/threats/technologies/wpfunnels). Vendors: [WPFunnels](https://junglewise.ai/threats/vendors/wpfunnels).

## Quick answers

**Is CVE-2026-79632 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79632 being exploited in the wild.

**How severe is CVE-2026-79632?** Medium severity, with a CVSS score of 5.3, published 4 September 2026.

**Which products and versions are affected?** WPFunnels before 3.13.0.

**Is there a fix for CVE-2026-79632?** A patch was published on 2026-09-02: Fixed in version 3.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79632 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-79632?** Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control flaw (CWE-862) in the wpfnl_shortcode_optin_submission AJAX handler. The plugin fails to perform authorization checks, nonce validation, or CSRF protection on email submission requests. An unauthenticated attacker can send a POST request to wp-admin/admin-ajax.php with the action parameter set to wpfnl_shortcode_optin_submission and inject arbitrary recipient email addresses (comma-separated), subject lines, and message body content via request parameters (admin_email, admin_email_subject, postData). The plugin processes these values without validation, directly interpolating attacker-supplied content into email templates and sending them from the site's own email address. The vulnerability requires no special configuration, active funnels, or opt-in forms to exploit, and the plugin's reCAPTCHA check can be bypassed by omitting its configuration flag. WPFunnels 3.13.0 and later include the fix; all earlier versions are affected.

## Affected products

- WPFunnels WPFunnels before 3.13.0

## Timeline

- 2026-09-02: disclosed
- 2026-09-04: other: CVE-2026-79632 published
- 2026-09-02: patched: Fixed in version 3.13.0

## References

- [https://wpscan.com/vulnerability/45abb077-c4ed-472e-8658-443506605235/](https://wpscan.com/vulnerability/45abb077-c4ed-472e-8658-443506605235/)

## Related threats

- [WPFunnels missing authorization in AJAX payment handler](https://junglewise.ai/threats/cve-2026-84908-wpfunnels-missing-authorization-in-ajax-payment-handler)
- [WPFunnels WordPress plugin information disclosure via web-accessible logs](https://junglewise.ai/threats/cve-2026-79631-wpfunnels-wordpress-plugin-information-disclosure-via-web)
- [WPFunnels checkout order bump product substitution allowing price manipulation](https://junglewise.ai/threats/cve-2026-79630-wpfunnels-checkout-order-bump-product-substitution-allowing-price)
- [WPFunnels WordPress plugin unauthenticated user registration bypass](https://junglewise.ai/threats/cve-2025-15691-wpfunnels-wordpress-plugin-unauthenticated-user-registration)
- [WPFunnels broken access control vulnerability](https://junglewise.ai/threats/cve-2026-84754-wpfunnels-broken-access-control-vulnerability)