CVE-2026-79632 — WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission

CVE-2026-79632

WPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission PUBLISHED

Description (CNA)

The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.

Affected (CNA)

Vendor / product	Versions
Unknown / WPFunnels	affected 3.1.0 before 3.13.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/45abb077-c4ed-472e-8658-443506605235/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.