5.3
Medium
CVE-2026-79632 The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in…
Description
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPFunnels 3.1 | 3.1.0 → < 3.13.0 | 3.13.0 |
Other CVEs of WPFunnels
The 4 CVEs of WPFunnels →
CVE-2026-79631
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable…
5.3
Medium
CVE-2026-79630
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump…
5.3
Medium
CVE-2025-15691
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before…
5.3
Medium