Unauthorized User Registration Vulnerability in WPFunnels Plugin for WordPress

CVE-2025-12353

What is CVE-2025-12353?

The WPFunnels plugin, designed for building sales funnels on WordPress and WooCommerce, is susceptible to a vulnerability that allows unauthorized user registration. This issue arises because the plugin inappropriately utilizes a user-controlled value, 'optin_allow_registration', to dictate user registration permissions, rather than relying on the intended site-specific settings. Consequently, this oversight enables unauthenticated attackers to create new user accounts, even in scenarios where user registration is meant to be restricted. As a result, site owners using versions up to 3.6.2 of WPFunnels must take immediate action to secure their installations against potential abuse.

References