CVE-2026-79632 in WPFunnels Plugin
Summary
by MITRE • 09/04/2026
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in WPFunnels versions prior to 3.13.0 represents a critical failure in access control mechanisms within the WordPress plugin ecosystem. Specifically, one of the opt-in submission handlers lacks both authorization checks and nonce verification. In standard web application security practices, particularly within content management systems like WordPress, nonces are essential for preventing Cross-Site Request Forgery attacks by ensuring that requests originate from legitimate users who have authenticated intent. The absence of these safeguards means that any unauthenticated actor on the internet can interact with this endpoint without providing valid credentials or proof of user session integrity. This fundamental flaw bypasses the intended security boundary, allowing external entities to execute administrative-level actions as if they were authorized administrators or logged-in users.
The technical exploitation vector involves manipulating HTTP requests to target the vulnerable opt-in submission handler. Because the plugin accepts notification recipients and email subjects directly from the request parameters without validation against a whitelist of allowed destinations or formats, an attacker can craft malicious payloads that specify arbitrary email addresses in the recipient field and custom text for the subject line. This capability transforms the WordPress site into a relay server capable of sending unsolicited emails to any destination chosen by the attacker. The lack of input sanitization further exacerbates the risk, as it allows for potential injection attacks or abuse of mail servers that may have strict reputation policies regarding outbound spam sources.
The operational impact of this vulnerability is significant and multifaceted. Primarily, it enables mass email distribution campaigns where attackers can use the compromised WordPress site to send phishing emails, malware links, or other malicious content to large lists of recipients. This not only facilitates direct harm to end-users but also severely damages the reputation of the affected website's domain. Email service providers and spam filters often blacklist domains associated with high volumes of unsolicited mail, leading to legitimate business communications being marked as spam or blocked entirely. Furthermore, the abuse of server resources for sending these emails can degrade site performance and potentially trigger hosting provider suspensions due to policy violations regarding unauthorized email blasting.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control, specifically reflecting failures in authorization checks that allow unauthenticated users to perform privileged actions. It also maps to the Cross-Site Request Forgery (CSRF) attack patterns documented in MITRE ATT&CK technique T1566.002, which covers Spearphishing Links and attachments delivered via web applications. The ability to send arbitrary emails further implicates CWE-94 Improper Control of Generation of Code or Script, although the primary vector here is abuse rather than code injection per se.
To mitigate this vulnerability, immediate action must be taken by upgrading WPFunnels to version 3.13.0 or later, where these authorization and nonce checks have been implemented. For sites that cannot immediately upgrade due to compatibility constraints, temporary mitigations include restricting access to the specific endpoint via web application firewall rules if possible, although this is less effective than patching. Additionally, administrators should review server-side mail logs for signs of abuse and consider implementing rate limiting on email-sending functions at the hosting level. Long-term security hygiene involves ensuring that all plugins are kept up-to-date and regularly auditing custom code or third-party integrations for proper implementation of CSRF protections and input validation standards.