What is the CVSS score of CVE-2026-3645?

CVE-2026-3645 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-3645?

Organizations using for WordPress is vulnerable to Missing Authorization in all should be aware of moderate risk from CVE-2026-3645, a missing authorization vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2026-3645?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Missing Authorization in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-3645

EUVD-2026-14170 MEDIUM

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-p6xf-h6c6-2mx9

Authentication Bypass WordPress PHP

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14170

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 5.3

DescriptionCVE.org

The Punnel - Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1. The save_config() function, which handles the 'punnel_save_config' AJAX action, lacks any capability check (current_user_can()) and nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's entire configuration including the API key via a POST request to admin-ajax.php. Once the API key is known (because the attacker set it), the attacker can use the plugin's public API endpoint (sniff_requests() at /?punnel_api=1) - which only validates requests by comparing a POST token against the stored api_key - to create, update, or delete arbitrary posts, pages, and products on the site.

AnalysisAI

The Punnel - Landing Page Builder WordPress plugin contains a critical missing authorization vulnerability in the save_config() AJAX function that allows authenticated attackers with Subscriber-level privileges to overwrite the plugin's configuration and API key without proper capability checks or nonce verification. Combined with an insecure public API endpoint (sniff_requests()) that only validates requests via token comparison, attackers can subsequently create, update, or delete arbitrary posts, pages, and products on affected WordPress installations. The vulnerability affects all versions up to and including 1.3.1 and has been documented by Wordfence with publicly available code references.

Technical ContextAI

The vulnerability involves two connected security flaws in the Punnel – Landing Page Builder plugin (cpe:2.3:a:punnel:punnel_–_landing_page_builder:*:*:*:*:*:*:*:*) running on WordPress. First, the save_config() function handling the 'punnel_save_config' AJAX action lacks the WordPress current_user_can() capability check and wp_verify_nonce() nonce validation, falling under CWE-862 (Missing Authorization). Second, the public API endpoint /?punnel_api=1 implements only token-based authentication by comparing a POST token against a stored API key, creating a logical weakness when that key can be attacker-controlled. The attack chain exploits PHP's AJAX handler (admin-ajax.php) which normally requires authentication but not role-based authorization, combined with WordPress's post manipulation functions which become exploitable once API credentials are compromised.

RemediationAI

Update the Punnel – Landing Page Builder plugin to a version newer than 1.3.1 immediately if available, or disable and remove the plugin until a patch is released. As a temporary mitigation if the plugin must remain active, implement a Web Application Firewall (WAF) rule to block POST requests to /wp-admin/admin-ajax.php with action=punnel_save_config, restrict admin-ajax.php access to trusted IP ranges via .htaccess or reverse proxy, and limit user registration to trusted administrators only to reduce the number of Subscriber accounts that could be compromised. Additionally, monitor WordPress post creation and modification logs for suspicious activity and ensure the API key stored by the plugin is rotated regularly and handled as a sensitive credential. Review the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b6f54ca4-297f-44e8-8bb3-25cdc52f94ff for detailed patch information once available.