Unauthenticated User Account Creation in WPFunnels WordPress Plugin

Executive Summary

The WPFunnels WordPress plugin before version 3.13.0 has a flaw where it does not verify if user registration is enabled on a site before creating accounts from opt-in form submissions. Instead, it relies on a value sent in the request, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the WPFunnels plugin. If it is below 3.13.0, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files for version details.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to create unauthorized WordPress user accounts on your site, potentially gaining access to sensitive areas or performing malicious actions. This could lead to site compromise, data theft, or further attacks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized user account creation. Unauthenticated attackers could create WordPress accounts even when registration is disabled, which may lead to unauthorized access to sensitive data or systems. This could violate data protection requirements under GDPR (e.g., unauthorized processing of personal data) and HIPAA (e.g., unauthorized access to protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Update the WPFunnels plugin to version 3.13.0 or later immediately. Disable user registration if not needed or restrict it to specific roles.

Useful 0 Not Useful 0