WPFunnels Plugin CVE-2025-15691

Exploitation requires WPFunnels plugin version 3.6.3 through 3.12.x to be installed and active on a WordPress site. The vulnerability is most impactful when the site's WordPress user registration is disabled (Settings > General > Anyone can register unchecked) - sites with open registration are not meaningfully affected since attackers can register through normal means. The attacker must target one of the two registration code paths not covered by the 3.6.3 patch; no authentication, elevated privileges, or user interaction is required. The created account likely defaults to subscriber role unless the site has configured a different default role.

The CVSS 5.3 Medium rating with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately captures the direct impact ceiling: an attacker can create WordPress user accounts but cannot read data or disrupt availability through this vulnerability alone. The real-world risk is contextually higher than the score implies for two reasons. First, unauthorized accounts are a common pivot point - attacker-controlled subscriber-level accounts can be exploited in chained attacks against other vulnerable plugins that incorrectly gate functionality on any authenticated role. Second, the incomplete-fix history means administrators who patched CVE-2025-12353 by updating to 3.6.3 or later (through 3.12.x) may have a false sense of security and deprioritized this follow-on issue. A public POC/exploit is confirmed via WPScan, substantially lowering the exploitation bar. The vulnerability is not listed in CISA KEV, suggesting no confirmed mass exploitation at time of analysis. EPSS data is not provided in the input.

An unauthenticated attacker sends a crafted HTTP POST request to the WPFunnels opt-in form AJAX handler, setting the request's registration-permission parameter to a truthy value. The plugin accepts this client-controlled value as authoritative, bypasses the WordPress site-level registration restriction, and inserts a new user record into the database. A public POC is available via WPScan, making this attack trivially scriptable for mass scanning.