WPFunnels EUVD-2026-70906

No authentication, nonce, or special site configuration is required - the vulnerable handler is registered for unauthenticated WordPress AJAX callers (nopriv). The plugin must be installed and active on a WordPress site running version 3.1.0 through 3.12.x, and the site must have functional outbound email (wp_mail with a configured mail relay or SMTP). Exploitation is limited strictly to outbound email abuse: attackers cannot read site data, modify stored content, execute server-side code, or cause a denial of service through this flaw alone. Sites with outbound email disabled or blocked at the network perimeter are not vulnerable to the primary abuse scenario. CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against default-installed configurations of WPFunnels.

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately characterizes the limited but real harm: no confidentiality or availability impact, and integrity impact constrained to outbound email abuse. The vulnerability is trivially exploitable - no authentication, no complexity, and no user interaction required - meaning any scripted scanner can identify and abuse it at scale. A publicly available PoC via WPScan confirms this, and opportunistic bulk exploitation of exposed WordPress plugins is a well-established attacker behavior. The primary real-world consequence is email reputation damage: attackers can send phishing lures or spam from the victim site's trusted sending domain, bypassing filters that allowlist the domain. There is no KEV listing, so confirmed widespread exploitation is not established. EPSS data was not provided. Even a mid-sized municipal IT team in gdynia managing a WordPress estate should treat this as a low-severity-but-high-probability abuse vector worth patching promptly, especially given that the site's sender reputation is a shared resource across all its outbound email.

An attacker scans for WordPress sites running WPFunnels 3.1.0-3.12.x and sends a crafted unauthenticated HTTP POST request to the vulnerable handler, supplying a list of target email addresses and a phishing subject line in the request body. The site's mail server dispatches the emails from its own authenticated sending domain to the specified recipients, bypassing spam filters that trust the domain. A publicly available PoC from WPScan confirms this attack path requires no special tooling or credentials.