Wpfunnels
Monthly
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all versions up to and including 1.31.0, allowing remote attackers to inject a crafted serialized PHP object that is deserialized by the plugin. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack and rated CVSS 9.8; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stored or reflected cross-site scripting in WPFunnels Pro WordPress plugin versions 2.9.4 and earlier allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser when they interact with crafted content. The CVSS 3.1 score of 7.1 reflects the scope-changed impact (S:C) on the WordPress site, including potential session hijacking of administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1.18) that allows authenticated or unauthenticated attackers to escalate their privileges within the application. This CWE-266 flaw enables attackers to gain unauthorized administrative or elevated access, potentially compromising the entire LMS installation and user data. While CVSS and EPSS scores are not yet publicly available, the privilege escalation nature and confirmed vulnerability status indicate significant real-world risk, particularly for WordPress installations managing educational content and user accounts.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visitor to retrieve customer order details and opt-in form submission data by directly requesting a predictable log file URL within the public uploads directory. The flaw affects e-commerce funnel operators who may store customer PII - names, emails, purchase data - in these logs, with potential GDPR/privacy regulatory consequences beyond the C:L CVSS rating suggests. A publicly available proof-of-concept exists; no public exploit or CISA KEV listing indicates active mass exploitation at time of analysis.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication or user interaction against default installations. Partial confidentiality and integrity impact (C:L/I:L) suggests attackers can read or modify data - such as subscriber lists, campaign settings, or plugin configuration - without holding any WordPress account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers to invoke restricted plugin actions without authorization. The CVSS vector (PR:N/UI:N/AV:N) confirms no credentials or user interaction are required to trigger the flaw. Impact is bounded to limited integrity and availability degradation (I:L/A:L) with no confidentiality exposure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.0.6. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated PHP Object Injection affects the Mail Mint email-marketing plugin for WordPress (by WPFunnels) in all versions up to and including 1.31.0, allowing remote attackers to inject a crafted serialized PHP object that is deserialized by the plugin. If a suitable POP gadget chain is present in the plugin, WordPress core, or another installed plugin, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack and rated CVSS 9.8; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Stored or reflected cross-site scripting in WPFunnels Pro WordPress plugin versions 2.9.4 and earlier allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser when they interact with crafted content. The CVSS 3.1 score of 7.1 reflects the scope-changed impact (S:C) on the WordPress site, including potential session hijacking of administrators. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An Incorrect Privilege Assignment vulnerability exists in WPFunnels Creator LMS plugin (versions up to and including 1.1.18) that allows authenticated or unauthenticated attackers to escalate their privileges within the application. This CWE-266 flaw enables attackers to gain unauthorized administrative or elevated access, potentially compromising the entire LMS installation and user data. While CVSS and EPSS scores are not yet publicly available, the privilege escalation nature and confirmed vulnerability status indicate significant real-world risk, particularly for WordPress installations managing educational content and user accounts.
Unauthenticated email relay abuse in WPFunnels WordPress plugin versions 3.1.0 through 3.12.x allows any remote visitor to send emails from the affected site to arbitrary recipients with arbitrary subjects. The opt-in submission handler accepts notification recipients and email subject lines directly from HTTP request parameters without performing authorization checks or WordPress nonce validation, turning the site's trusted mail infrastructure into an open relay. A publicly available exploit exists via WPScan; vendor-released patch 3.13.0 closes the gap.
Unauthenticated log file exposure in WPFunnels WordPress plugin (versions 2.6.0 through <3.13.0) enables any remote visitor to retrieve customer order details and opt-in form submission data by directly requesting a predictable log file URL within the public uploads directory. The flaw affects e-commerce funnel operators who may store customer PII - names, emails, purchase data - in these logs, with potential GDPR/privacy regulatory consequences beyond the C:L CVSS rating suggests. A publicly available proof-of-concept exists; no public exploit or CISA KEV listing indicates active mass exploitation at time of analysis.
Price manipulation in WPFunnels WordPress plugin before 3.13.0 allows unauthenticated attackers to apply a configured order bump discount to any purchasable WooCommerce product rather than only the specific product the discount was intended for, causing the fraudulently reduced price to carry through to the completed order total. The vulnerability stems from absent server-side validation of the product-to-discount pairing during order bump processing, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). A publicly available exploit exists via WPScan, and a vendor-released patch is available in version 3.13.0.
Unauthorized WordPress account creation in WPFunnels (versions 3.6.3 through before 3.13.0) allows unauthenticated remote attackers to register user accounts on sites where WordPress registration is explicitly disabled. The plugin trusts a client-supplied boolean in the opt-in form submission request rather than querying the server-side registration setting, making the site-level restriction trivially bypassable. This is an incomplete patch for CVE-2025-12353 - the fix applied in 3.6.3 closed only one of three registration code paths, leaving sites that updated to 3.6.3 through 3.12.x still vulnerable and falsely believing they were protected.
Broken access control in the Mail Mint WordPress plugin (≤1.31.0) exposes one or more endpoints to unauthenticated remote attackers due to missing authorization checks (CWE-862). The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication or user interaction against default installations. Partial confidentiality and integrity impact (C:L/I:L) suggests attackers can read or modify data - such as subscriber lists, campaign settings, or plugin configuration - without holding any WordPress account. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Broken access control in the WPFunnels WordPress plugin (versions <= 3.12.13) permits unauthenticated remote attackers to invoke restricted plugin actions without authorization. The CVSS vector (PR:N/UI:N/AV:N) confirms no credentials or user interaction are required to trigger the flaw. Impact is bounded to limited integrity and availability degradation (I:L/A:L) with no confidentiality exposure, and no public exploit or CISA KEV listing has been identified at time of analysis.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.0.6. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.