CVE-2026-79632: WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated users can exploit the affected opt-in submission handler. No login, authorization check, or nonce validation is required for that handler.
What can an attacker control in the emails sent by the site?
An attacker can supply arbitrary notification recipient addresses and an arbitrary email subject through the request. The affected site can therefore be used to send emails to attacker-selected recipients.
Are installations running WPFunnels 3.13.0 affected?
The issue is described as affecting WPFunnels versions before 3.13.0. Version 3.13.0 is not identified as affected.