CVE-2025-12353: WPFunnels Auth Bypass Vulnerability

CVE-2025-12353 Overview

CVE-2025-12353 affects the WPFunnels plugin for WordPress, a funnel builder used with WooCommerce for lead collection and sales. All versions up to and including 3.6.2 are vulnerable to unauthorized user registration. The plugin trusts a user-controlled parameter, optin_allow_registration, to determine whether registration is permitted, rather than checking the site's own registration setting. Unauthenticated attackers can create new user accounts even when the WordPress administrator has disabled registration. The flaw is categorized under [CWE-639] Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers can register accounts on WordPress sites where registration is disabled, bypassing the site owner's access control policy.

Affected Products

WPFunnels plugin for WordPress versions up to and including 3.6.2
WordPress sites running WPFunnels with user registration disabled
WooCommerce deployments integrating WPFunnels for lead capture

Discovery Timeline

2025-11-08 - CVE-2025-12353 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12353

Vulnerability Analysis

The vulnerability resides in the WPFunnels public-facing registration handler, class-wpfnl-public.php. The plugin exposes a checkout or opt-in flow that can create WordPress user accounts as part of the funnel process. Instead of consulting the WordPress core option users_can_register, the plugin reads a request parameter named optin_allow_registration and uses that value to gate the account creation code path.

Because the parameter travels with the request from the client, an unauthenticated attacker can submit the registration request with optin_allow_registration set to a truthy value. The plugin then proceeds to create a new WordPress user regardless of the site's actual configuration. This grants attackers a foothold as an authenticated subscriber-level user, which can be used to reach authenticated-only attack surface in other plugins or themes.

Root Cause

The root cause is an authorization decision based on attacker-controlled input. The plugin treats a request-supplied flag as authoritative rather than validating against the server-side WordPress setting. This is a classic [CWE-639] pattern where a security control relies on data the requester can modify.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request to the WPFunnels registration endpoint containing account details and the optin_allow_registration flag. The server creates the WordPress account and returns success. Refer to the WordPress Code Change Log and the Wordfence Vulnerability Report for technical details on the patched logic.

Detection Methods for CVE-2025-12353

Indicators of Compromise

New WordPress user accounts created with a subscriber or comparable default role while the users_can_register option is set to 0.
HTTP POST requests to WPFunnels endpoints containing the parameter optin_allow_registration set to a truthy value.
Spikes in user_register events in WordPress logs originating from unauthenticated sessions.

Detection Strategies

Audit the wp_users table for accounts created after installation of WPFunnels 3.6.2 or earlier that do not correspond to legitimate customer activity.
Inspect web server access logs for requests to WPFunnels funnel or checkout URLs that include the optin_allow_registration field.
Correlate account creation timestamps with WPFunnels request logs to identify programmatic abuse.

Monitoring Recommendations

Enable WordPress audit logging to record every user_register action along with source IP and request path.
Alert when new accounts appear despite the WordPress registration setting being disabled.
Monitor for a single IP address creating multiple accounts within a short time window across WPFunnels endpoints.

How to Mitigate CVE-2025-12353

Immediate Actions Required

Update the WPFunnels plugin to the version released after 3.6.2 that includes the fix in changeset 3389604.
Review all existing WordPress user accounts and remove any that were not created by a legitimate administrator or customer.
Force password resets for accounts of uncertain provenance and invalidate active sessions.

Patch Information

The vendor addressed the issue by removing reliance on the optin_allow_registration request parameter and instead checking the WordPress core users_can_register option. The patched code is available in the WordPress plugin repository changeset 3389604. Site owners should upgrade to the fixed release published on the WordPress.org plugin directory.

Workarounds

Deactivate the WPFunnels plugin until the update can be applied if immediate patching is not possible.
Deploy a web application firewall rule that blocks requests to WPFunnels endpoints containing the optin_allow_registration parameter.
Restrict access to the WPFunnels registration and checkout endpoints by IP allow-list where feasible.

bash

# Example WAF rule to block the vulnerable parameter
SecRule ARGS:optin_allow_registration ".*" \
  "id:1012353,phase:2,deny,status:403,\
  msg:'CVE-2025-12353 WPFunnels unauthorized registration attempt'"