PT-2025-45553 · Automattic+1 · Woocommerce+1

Published 2025-11-08 · Updated 2025-11-08 · CVE-2025-12353

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales versions prior to 3.6.3

Description The WPFunnels plugin for WordPress is susceptible to unauthorized user registration. The plugin incorrectly relies on a user-controlled value, optin allow registration, to determine if user registration is permitted, rather than utilizing the site-specific setting. This allows unauthenticated attackers to create new user accounts, even when user registration is disabled on the WordPress site.

Recommendations Update WPFunnels to version 3.6.3 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12353

Affected Products

Wpfunnels

Woocommerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12353 · Security Note
• https://twitter.com/VulmonFeeds/status/1987100042021232772 · Twitter Post
• https://t.me/CVEtracker/36847 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3389604/wpfunnels/trunk/public/class-wpfnl-public.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4e376c96-47a8-419f-ab45-f7c46510c767?source=cve · Note
• https://twitter.com/CVEnew/status/1987011687711375371 · Twitter Post