Missing Authorization in Punnel – Landing Page Builder Plugin for WordPress

CVE-2026-3645

What is CVE-2026-3645?

The Punnel – Landing Page Builder plugin for WordPress contains a critical vulnerability that allows authenticated attackers, starting from Subscriber-level access, to exploit the absence of proper authorization checks. In versions up to and including 1.3.1, the save_config() function fails to validate user capabilities and nonce verification, enabling attackers to send a POST request to the admin-ajax.php endpoint and overwrite the entire plugin configuration. This potentially exposes sensitive details such as the API key. Once compromised, attackers can leverage the public API endpoint to create, modify, or delete content, leading to unauthorized changes on the website.

References