CVE-2025-12353
BaseFortify
Publication date: 2025-11-08
Last updated on: 2025-11-12
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpfunnels | wpfunnels | 3.6.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the WPFunnels WordPress plugin up to version 3.6.2, where the plugin incorrectly uses a user-controlled value 'optin_allow_registration' to decide if user registration is allowed, instead of the site's actual setting. This flaw allows unauthenticated attackers to register new user accounts even when user registration is supposed to be disabled.
How can this vulnerability impact me? :
The vulnerability can allow unauthorized users to create accounts on your WordPress site without permission, potentially leading to unauthorized access, spam, or abuse of site resources. This could undermine site security and trust.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the WPFunnels plugin to a version later than 3.6.2 where the issue is fixed. If an update is not available, disable user registration on your WordPress site to prevent unauthorized account creation until a patch is applied.