Wpfunnels
Monthly
Arbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticated user holding only Contributor-level privileges upload a file of an attacker-chosen type to the web server, which can be leveraged to drop and execute server-side code on the host. The vulnerability is rated Critical (CVSS 3.1 base 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting no user interaction and no administrative access requirement once a Contributor account exists, with scope change indicating impact beyond the plugin itself to the underlying site. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, though the low privilege bar and the open-registration patterns common on LMS sites make this a high-priority item for any WordPress installation running this plugin.
Unauthenticated cross-site scripting in the WPFunnels WordPress plugin at versions 3.13.1 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser within the target site's origin once the victim loads or clicks a crafted link or request. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms no authentication is required but that victim interaction is necessary, and the Changed scope means the injected script can affect resources beyond the vulnerable plugin while confidentiality, integrity, and availability impacts remain partial. No public exploit code and no active exploitation were identified at time of analysis, and the provided intelligence contains no CISA KEV listing and no EPSS score.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Reflected cross-site scripting (XSS) in WPFunnels plugin versions 3.13.1 and earlier allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when they are tricked into clicking a crafted link. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network-reachable, low-complexity exploitation requiring user interaction but no authentication, with a scope change and limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all versions up to and including 1.31.0, allowing remote attackers to inject a crafted serialized PHP object that is deserialized by the plugin. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack and rated CVSS 9.8; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stored or reflected cross-site scripting in WPFunnels Pro WordPress plugin versions 2.9.4 and earlier allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser when they interact with crafted content. The CVSS 3.1 score of 7.1 reflects the scope-changed impact (S:C) on the WordPress site, including potential session hijacking of administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1.18) that allows authenticated or unauthenticated attackers to escalate their privileges within the application. This CWE-266 flaw enables attackers to gain unauthorized administrative or elevated access, potentially compromising the entire LMS installation and user data. While CVSS and EPSS scores are not yet publicly available, the privilege escalation nature and confirmed vulnerability status indicate significant real-world risk, particularly for WordPress installations managing educational content and user accounts.
WPFunnels WordPress plugin versions through 3.13.5 contain a cross-site request forgery flaw that allows a remote attacker to induce a logged-in privileged WordPress user into performing a low-integrity state change in the plugin; confidentiality and availability are not affected. The issue is rated CVSS 4.3 and requires victim interaction, with the practical risk concentrated on privileged sessions that can carry out WPFunnels actions. No public exploit identified at time of analysis.
WPFunnels, a WordPress sales-funnel and checkout plugin, ships a missing-authorization flaw in versions up to and including 3.13.5 that lets remote requests reach functionality they should not be allowed to invoke, resulting in unauthorized but limited modification of site data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) shows the weakness is reachable over the network without credentials or user interaction, but impact is constrained to integrity only - no confidentiality loss and no denial of service. No public exploit code or active exploitation is confirmed in the available data, and the vendor reference points to a Patchstack advisory for the 3.13.5 broken-access-control report; this is a moderate, not urgent, issue that should be scheduled into the normal monthly patch cycle.
Missing authorization (CWE-862) in the WPFunnels WordPress plugin through version 3.13.5 lets remote attackers perform a limited unauthorized modification of site state without authenticating. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U with C:N/I:L/A:N, so the confirmed consequence is a narrow integrity impact with no disclosure or denial of service, and the specific feature or endpoint that triggers the flaw is not described in the available sources. Reported by Patchstack and prioritized as this_month; no CISA KEV listing, EPSS figure, or verified working exploit code is present in the supplied data, so the exposure should be treated as a default-deployment access control gap on internet-facing WordPress installations rather than an actively exploited campaign.
Stored cross-site scripting in the WPFunnels WordPress plugin, affecting all versions through 3.13.3, lets an authenticated low-privileged user persist malicious JavaScript into funnel content that then executes in the browser of any higher-privileged user who later views the affected page. The flaw is rated CVSS 6.5 (Medium) under vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating an authenticated attack path (PR:L) with a required victim interaction (UI:R) and a scope change (S:C) but only low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is realistically limited to sites that grant untrusted or low-privileged accounts the ability to write to WPFunnels funnel fields.
Unauthenticated attackers can exploit an insecure direct object reference (IDOR) in WPFunnels 3.13.1 and earlier to read or alter funnel-related objects they do not own. The flaw has a CVSS base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting remote, unauthenticated exploitation with low confidentiality and integrity impact but no availability impact. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE; the risk is assessed as moderate, pragmatic risk, with impact limited to the exposed funnel objects.
WordPress sites running the WPFunnels Creator LMS plugin at version 1.2.19 or earlier expose an authenticated manipulation and disclosure weakness, where improper validation of a specified quantity value lets an attacker with a Subscriber-level account or higher read limited data and alter limited plugin content (CVSS 5.4, C:L/I:L/A:N). Exploitation is network-reachable, low complexity, and requires no victim interaction, but remains gated behind the low-privilege login prerequisite, which is trivial to satisfy on sites with open user registration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuinely low-priority issue despite the MEDIUM base score.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visitor to retrieve customer order details and opt-in form submission data by directly requesting a predictable log file URL within the public uploads directory. The flaw affects e-commerce funnel operators who may store customer PII - names, emails, purchase data - in these logs, with potential GDPR/privacy regulatory consequences beyond the C:L CVSS rating suggests. A publicly available proof-of-concept exists; no public exploit or CISA KEV listing indicates active mass exploitation at time of analysis.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication or user interaction against default installations. Partial confidentiality and integrity impact (C:L/I:L) suggests attackers can read or modify data - such as subscriber lists, campaign settings, or plugin configuration - without holding any WordPress account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers to invoke restricted plugin actions without authorization. The CVSS vector (PR:N/UI:N/AV:N) confirms no credentials or user interaction are required to trigger the flaw. Impact is bounded to limited integrity and availability degradation (I:L/A:L) with no confidentiality exposure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.0.6. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticated user holding only Contributor-level privileges upload a file of an attacker-chosen type to the web server, which can be leveraged to drop and execute server-side code on the host. The vulnerability is rated Critical (CVSS 3.1 base 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting no user interaction and no administrative access requirement once a Contributor account exists, with scope change indicating impact beyond the plugin itself to the underlying site. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, though the low privilege bar and the open-registration patterns common on LMS sites make this a high-priority item for any WordPress installation running this plugin.
Unauthenticated cross-site scripting in the WPFunnels WordPress plugin at versions 3.13.1 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser within the target site's origin once the victim loads or clicks a crafted link or request. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms no authentication is required but that victim interaction is necessary, and the Changed scope means the injected script can affect resources beyond the vulnerable plugin while confidentiality, integrity, and availability impacts remain partial. No public exploit code and no active exploitation were identified at time of analysis, and the provided intelligence contains no CISA KEV listing and no EPSS score.
Authenticated path traversal in the WordPress Creator LMS plugin (WPFunnels) affects all versions up to and including 1.2.19 and allows a user holding only Contributor-level privileges to manipulate file paths and reach files outside the intended directory, primarily exposing sensitive data with limited integrity and availability effects. Exploitation requires a valid low-privilege account - self-registration must be enabled or an account otherwise obtained - and is rated high complexity (AC:H), meaning success depends on specific, not-guaranteed conditions; the issue is remote, needs no user interaction, and no public exploit has been identified at time of analysis. It is not confirmed actively exploited (no CISA KEV listing), and while the vendor-supplied CVSS of 7.5 and the scorer's high confidentiality/integrity/availability ratings read alarming, the practical risk is moderate because the attack is gated behind an authenticated Contributor role and elevated complexity.
Reflected cross-site scripting (XSS) in WPFunnels plugin versions 3.13.1 and earlier allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when they are tricked into clicking a crafted link. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network-reachable, low-complexity exploitation requiring user interaction but no authentication, with a scope change and limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all versions up to and including 1.31.0, allowing remote attackers to inject a crafted serialized PHP object that is deserialized by the plugin. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack and rated CVSS 9.8; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stored or reflected cross-site scripting in WPFunnels Pro WordPress plugin versions 2.9.4 and earlier allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser when they interact with crafted content. The CVSS 3.1 score of 7.1 reflects the scope-changed impact (S:C) on the WordPress site, including potential session hijacking of administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1.18) that allows authenticated or unauthenticated attackers to escalate their privileges within the application. This CWE-266 flaw enables attackers to gain unauthorized administrative or elevated access, potentially compromising the entire LMS installation and user data. While CVSS and EPSS scores are not yet publicly available, the privilege escalation nature and confirmed vulnerability status indicate significant real-world risk, particularly for WordPress installations managing educational content and user accounts.
WPFunnels WordPress plugin versions through 3.13.5 contain a cross-site request forgery flaw that allows a remote attacker to induce a logged-in privileged WordPress user into performing a low-integrity state change in the plugin; confidentiality and availability are not affected. The issue is rated CVSS 4.3 and requires victim interaction, with the practical risk concentrated on privileged sessions that can carry out WPFunnels actions. No public exploit identified at time of analysis.
WPFunnels, a WordPress sales-funnel and checkout plugin, ships a missing-authorization flaw in versions up to and including 3.13.5 that lets remote requests reach functionality they should not be allowed to invoke, resulting in unauthorized but limited modification of site data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) shows the weakness is reachable over the network without credentials or user interaction, but impact is constrained to integrity only - no confidentiality loss and no denial of service. No public exploit code or active exploitation is confirmed in the available data, and the vendor reference points to a Patchstack advisory for the 3.13.5 broken-access-control report; this is a moderate, not urgent, issue that should be scheduled into the normal monthly patch cycle.
Missing authorization (CWE-862) in the WPFunnels WordPress plugin through version 3.13.5 lets remote attackers perform a limited unauthorized modification of site state without authenticating. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U with C:N/I:L/A:N, so the confirmed consequence is a narrow integrity impact with no disclosure or denial of service, and the specific feature or endpoint that triggers the flaw is not described in the available sources. Reported by Patchstack and prioritized as this_month; no CISA KEV listing, EPSS figure, or verified working exploit code is present in the supplied data, so the exposure should be treated as a default-deployment access control gap on internet-facing WordPress installations rather than an actively exploited campaign.
Stored cross-site scripting in the WPFunnels WordPress plugin, affecting all versions through 3.13.3, lets an authenticated low-privileged user persist malicious JavaScript into funnel content that then executes in the browser of any higher-privileged user who later views the affected page. The flaw is rated CVSS 6.5 (Medium) under vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating an authenticated attack path (PR:L) with a required victim interaction (UI:R) and a scope change (S:C) but only low confidentiality, integrity and availability impact. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is realistically limited to sites that grant untrusted or low-privileged accounts the ability to write to WPFunnels funnel fields.
Unauthenticated attackers can exploit an insecure direct object reference (IDOR) in WPFunnels 3.13.1 and earlier to read or alter funnel-related objects they do not own. The flaw has a CVSS base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), reflecting remote, unauthenticated exploitation with low confidentiality and integrity impact but no availability impact. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE; the risk is assessed as moderate, pragmatic risk, with impact limited to the exposed funnel objects.
WordPress sites running the WPFunnels Creator LMS plugin at version 1.2.19 or earlier expose an authenticated manipulation and disclosure weakness, where improper validation of a specified quantity value lets an attacker with a Subscriber-level account or higher read limited data and alter limited plugin content (CVSS 5.4, C:L/I:L/A:N). Exploitation is network-reachable, low complexity, and requires no victim interaction, but remains gated behind the low-privilege login prerequisite, which is trivial to satisfy on sites with open user registration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and this is assessed as a genuinely low-priority issue despite the MEDIUM base score.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visitor to retrieve customer order details and opt-in form submission data by directly requesting a predictable log file URL within the public uploads directory. The flaw affects e-commerce funnel operators who may store customer PII - names, emails, purchase data - in these logs, with potential GDPR/privacy regulatory consequences beyond the C:L CVSS rating suggests. A publicly available proof-of-concept exists; no public exploit or CISA KEV listing indicates active mass exploitation at time of analysis.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication or user interaction against default installations. Partial confidentiality and integrity impact (C:L/I:L) suggests attackers can read or modify data - such as subscriber lists, campaign settings, or plugin configuration - without holding any WordPress account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers to invoke restricted plugin actions without authorization. The CVSS vector (PR:N/UI:N/AV:N) confirms no credentials or user interaction are required to trigger the flaw. Impact is bounded to limited integrity and availability degradation (I:L/A:L) with no confidentiality exposure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.0.6. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.