Medium severity · published Nov 8, 2025
CVE-2025-12353
WPFunnels <= 3.6.2 - Unauthorized User Registration
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell · getwpfunnels
through 3.6.2 · source: vendor
Affected product
WF
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
getwpfunnels
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12353
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3389604/wpfunnels/trunk/public/class-wpfnl-public.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/4e376c96-47a8-419f-ab45-f7c46510c767?source=cve
More from WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
9.8
CVE-2026-14345
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
8.8
CVE-2026-15103
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
6.6
CVE-2026-13080
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
6.5
CVE-2025-12000
WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
6.4
CVE-2026-0626
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode