5.3
Moyenne
CVE-2026-79632 The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in…
Description
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| WPFunnels 3.1 | 3.1.0 → < 3.13.0 | 3.13.0 |
Autres CVE de WPFunnels
Les 4 CVE de WPFunnels →
CVE-2026-79631
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable…
5.3
Moyenne
CVE-2026-79630
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump…
5.3
Moyenne
CVE-2025-15691
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before…
5.3
Moyenne