Description

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T07:17:10.017Z",
  "pubdate": "2026-09-04T07:17:10.017Z",
  "executiveSummary": "The WPFunnels WordPress plugin, in versions prior to 3.13.0, contains a critical security vulnerability involving an improper access control implementation within its opt-in submission handler.\nThis vulnerability is classified as an Unauthenticated Email Injection or Arbitrary Email Sending vulnerability. It allows an unauthenticated remote attacker to leverage the affected plugin to send emails from the WordPress site's mail server to arbitrary recipients.\nThe root cause lies in the complete absence of authorization checks and nonce validation within the processing logic of the vulnerable endpoint. By failing to verify the request origin or user session, the plugin permits external parties to influence server-side email composition.\nThe impact is significant, as it facilitates mass unsolicited email distribution (spam) originating from a trusted domain, potentially damaging the site's reputation, blacklisting the server's IP address, or supporting phishing campaigns.\nExploitation requires no authentication or special privileges; it is performed via simple HTTP requests to the exposed handler. Remediation is strictly achieved by updating the WPFunnels plugin to version 3.13.0 or higher.",
  "technicalDetails": "The vulnerability resides within an opt-in submission handler of the WPFunnels plugin. Analysis reveals that the endpoint responsible for processing these submissions does not enforce any capability checks (e.g., current_user_can()) nor does it implement WordPress nonce verification to ensure request integrity.\nThe flaw stems from a lack of secure input handling and authentication enforcement. The application logic retrieves email parameters—specifically the notification recipient addresses and the subject line—directly from user-supplied request data without sanitizing or validating these inputs against an expected configuration or authorized manifest.\nAn attacker can exploit this by crafting a POST request directed at the vulnerable handler. By injecting arbitrary parameters into the request payload, the attacker effectively overrides the intended plugin logic. Because the server-side code trusts the user-supplied input to define the recipient and subject, the plugin's built-in email functionality will execute an outgoing SMTP or wp_mail() call using the attacker's specified values.\nThe attack flow is as follows: 1) The attacker identifies the vulnerable opt-in submission handler endpoint. 2) The attacker crafts an HTTP POST request, populating the body with parameters that the plugin expects to define email configuration. 3) The plugin processes the request without validating if the sender is authorized to trigger these notifications. 4) The server dispatches an email to the attacker-defined recipient containing the attacker-defined subject and potentially arbitrary body content.\nBecause the server's mail transport agent (MTA) sends these messages, they are often perceived by target mail servers as legitimate communications from the victim's domain. This capability exposes the host environment to being utilized as a relay for malicious operations. Post-exploitation impact includes, but is not limited to, the degradation of the domain's email deliverability reputation (Sender Score), potential blacklisting of the underlying server infrastructure by DNSBL providers, and the use of the site as a conduit for sophisticated social engineering or phishing attacks. There is no requirement for the attacker to possess an active user account or administrative credentials, as the handler is exposed to the public internet by default in vulnerable installations."
}