CVE-2025-15691: WPFunnels < 3.13.0 - Unauthenticated User Registration via Opt-in Forms
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled.
This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPFunnels WordPress pluginto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
What configurations are exposed?
Sites using WPFunnels versions before 3.13.0 are affected if they accept opt-in form submissions. WordPress registration being disabled does not prevent exploitation through the affected registration paths.
What does an attacker need to exploit this issue?
An attacker does not need to authenticate. They can submit an opt-in form request and supply the registration-related value relied on by the plugin to cause account creation.
Why might sites that addressed the earlier issue still be vulnerable?
Version 3.6.3 added a check for only one of WPFunnels' three registration paths. The remaining paths were not covered until version 3.13.0.