EUVD-2025-210844
GHSA-23pq-j2qq-jh57
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote HTTP exploitation with no preconditions; impact limited to unauthorized account creation with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled.
This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.
AnalysisAI
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
Technical ContextAI
WPFunnels is a WordPress funnel-builder plugin that includes opt-in form functionality capable of triggering new user registration. The root cause is CWE-863 (Incorrect Authorization): rather than calling WordPress core functions to verify the site's users_can_register option server-side, the plugin reads a parameter value from the incoming HTTP request to decide whether account creation should proceed. This trust-the-client pattern means an attacker can flip the parameter to force registration regardless of site configuration. The CVE description explicitly notes three distinct registration code paths exist in the plugin; CVE-2025-12353 led to a patch in 3.6.3 that only guarded one of them. The CPE is cpe:2.3:a:unknown:wpfunnels:*:*:*:*:*:*:*:* - the vendor field is unresolved in NVD data, though the product identity is unambiguous from the WPScan advisory.
RemediationAI
Update WPFunnels to version 3.13.0 or later, which closes all three registration code paths. The WPScan advisory at https://wpscan.com/vulnerability/c01926e9-f3e0-4bd5-9802-8f5f79a50504/ confirms 3.13.0 as the fully patched release. Sites that previously upgraded to 3.6.3 through 3.12.x in response to CVE-2025-12353 should treat this as an unresolved exposure and upgrade immediately. If immediate patching is not feasible, consider temporarily disabling WPFunnels opt-in form submission by deactivating the plugin, or deploying WAF rules to block POST requests to the WPFunnels AJAX registration endpoints - note this will disrupt funnel form functionality. After mitigation, audit the wp_users table for accounts created during the exposure window, particularly those with subscriber role and no legitimate origin.
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all ve
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visi
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured or
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1
Stored or reflected cross-site scripting in WPFunnels Pro WordPress plugin versions 2.9.4 and earlier allows unauthentic
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers t
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remot
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnel
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today