Description

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled. This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T07:17:07.293Z",
  "pubdate": "2026-09-04T07:17:07.293Z",
  "executiveSummary": "The WPFunnels WordPress plugin, in versions prior to 3.13.0, contains a critical security flaw involving improper authorization of user registration processes. This vulnerability is classified as an incomplete fix for CVE-2025-12353, as previous remediation efforts only addressed one of three distinct code execution paths for user account creation.\nThe vulnerability allows unauthenticated remote attackers to bypass site-wide registration restrictions, effectively enabling unauthorized account creation even when the 'Anyone can register' setting is disabled in the WordPress configuration. By manipulating specific request parameters, an attacker can force the plugin to instantiate new WordPress user accounts. This facilitates unauthorized access, potentially leading to privilege escalation, data exfiltration, or the establishment of a persistent foothold within the target environment. Given the potential for automated abuse, the risk is severe, particularly for sites that rely on registration control to maintain security posture and user integrity.\nThe flaw stems from the plugin's reliance on client-provided input to dictate registration logic rather than enforcing server-side checks against global WordPress settings. No complex authentication is required, making it a high-risk entry point for malicious actors.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient implementation of access control logic within the WPFunnels user registration module. Specifically, the plugin fails to perform a rigorous server-side validation of the 'users_can_register' WordPress option when processing opt-in form submissions. While a previous security update (version 3.6.3) attempted to mitigate this issue, the implementation only covered a single execution path, leaving two other registration routes unprotected.\nThe exploitation method involves an unauthenticated attacker crafting a malicious HTTP POST request targeting the WPFunnels endpoint responsible for processing opt-in submissions. Because the plugin logic relies on a user-controlled parameter within the request to determine if registration should proceed—rather than querying the site's 'get_option('users_can_register')' status—an attacker can bypass the intended registration restrictions by explicitly defining the submission as a valid registration request.\nThe attack flow proceeds as follows: First, the attacker identifies the API or AJAX endpoint utilized by WPFunnels for handling opt-in form submissions. Second, the attacker constructs a payload that mimics an opt-in submission while including the necessary parameters that the vulnerable function interprets as a request to create a new WordPress user account. Third, the server-side code, failing to perform a secondary check against the site’s global membership configuration, proceeds to call the 'wp_create_user' or equivalent user-instantiation function. Finally, the account is created, and the attacker receives confirmation of the successful registration.\nThis vulnerability is particularly dangerous because it bypasses the standard WordPress security paradigm where user registration is an opt-in administrative setting. By exploiting this flaw, an attacker can create accounts that are not explicitly authorized by the site administrator, potentially targeting subscriber-level access or higher depending on the default role assignments configured in the plugin. The lack of proper validation across all registration code paths ensures that even if one path is secured, the other remaining paths allow the attack to persist, rendering the application susceptible to unauthorized user creation on any WordPress instance where WPFunnels is installed and the vulnerable modules are active.\nThe exposure is network-wide, as the endpoint is accessible to any remote attacker with connectivity to the web server, requiring no active session or special privileges."
}