CVE-2025-12353

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12353", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-27T15:11:29.679Z", "datePublished": "2025-11-08T03:27:47.222Z", "dateUpdated": "2026-04-08T16:51:41.520Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:41.520Z"}, "affected": [{"vendor": "getwpfunnels", "product": "WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPFunnels \u2013 The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled."}], "title": "WPFunnels <= 3.6.2 - Unauthorized User Registration", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4e376c96-47a8-419f-ab45-f7c46510c767?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3389604/wpfunnels/trunk/public/class-wpfnl-public.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ahmed Rayen Ayari"}], "timeline": [{"time": "2025-10-27T15:28:20.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-07T15:06:12.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-10T19:55:24.670204Z", "id": "CVE-2025-12353", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T19:58:32.337Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12353", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-10T19:55:24.670204Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-10T19:55:30.136Z"}}], "cna": {"title": "WPFunnels <= 3.6.2 - Unauthorized User Registration", "credits": [{"lang": "en", "type": "finder", "value": "Ahmed Rayen Ayari"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "getwpfunnels", "product": "WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-27T15:28:20.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-07T15:06:12.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4e376c96-47a8-419f-ab45-f7c46510c767?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3389604/wpfunnels/trunk/public/class-wpfnl-public.php"}], "descriptions": [{"lang": "en", "value": "The WPFunnels \u2013 The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:41.520Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12353", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:41.520Z", "dateReserved": "2025-10-27T15:11:29.679Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-08T03:27:47.222Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell", "vendor": "getwpfunnels", "versions": [{"lessThanOrEqual": "3.6.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPFunnels \u2013 The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled."}, {"lang": "es", "value": "El plugin WPFunnels - The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales para WordPress es vulnerable a registro de usuario no autorizado en todas las versiones hasta la 3.6.2, inclusive. Esto se debe a que el plugin se basa en un valor controlado por el usuario 'optin_allow_registration' para determinar si el registro de usuario est\u00e1 permitido, en lugar de la configuraci\u00f3n espec\u00edfica del sitio. Esto hace posible que atacantes no autenticados registren nuevas cuentas de usuario, incluso cuando el registro de usuario est\u00e1 deshabilitado."}], "id": "CVE-2025-12353", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12353", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-10T19:55:24.670204Z", "version": "2.0.3"}}]}, "published": "2025-11-08T04:15:45.410", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3389604/wpfunnels/trunk/public/class-wpfnl-public.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4e376c96-47a8-419f-ab45-f7c46510c767?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T13:58:00.432334+00:00", "value": {"mitigation_remediation": ["Update the WPFunnels plugin to a version that fixes the flaw.", "If an immediate update is not possible, temporarily disable WordPress user registration in the Settings \u2192 General panel to prevent new accounts from being created.", "Additionally, set the 'optin_allow_registration' flag to false via the plugin settings or directly in the database to ensure the plugin cannot override the site registration setting."], "summary": {"action": "Apply Patch", "impact": "Unauthorized account registration"}, "threat_synthesis": {"affected_systems": "The affected product is the WordPress plugin WPFunnels \u2013 Funnel Builder for WooCommerce with Checkout & One Click Upsell, versions up to and including 3.6.2. Sites that have installed any of these versions are susceptible; no other vendors or product lines are listed.", "description_and_impact": "The vulnerability exists because the WPFunnels plugin trusts a user\u2011controlled setting called 'optin_allow_registration' to decide whether new users may register. When this flag is set to true, the plugin skips the site\u2011wide registration restriction and allows any visitor to create an account without authentication. This is a privilege escalation flaw (CWE\u2011639) that enables attackers to generate accounts that could be used for spam, phishing, or further exploitation of the WordPress site.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity. The EPSS score is less than 1\u202f%, showing that exploitation is unlikely to be seen widely, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the most probable attack path requires an unauthenticated user to submit a registration request that includes 'optin_allow_registration' set to a truthy value; no special privileges are needed. If a site protects itself by disabling WordPress registration or limiting account creation, the impact is mitigated but the flaw remains present if the plugin logic is not updated."}}}}, "created": "2025-11-10T09:33:38.151729+00:00", "updated": "2026-04-22T14:00:18.234428+00:00", "vendors": ["getwpfunnels", "getwpfunnels$PRODUCT$wpfunnels", "wordpress", "wordpress$PRODUCT$wordpress"]}