CVE-2026-3645: Punnel WordPress Plugin Auth Bypass Flaw

CVE-2026-3645 Overview

The Punnel – Landing Page Builder plugin for WordPress contains a Missing Authorization vulnerability affecting all versions up to and including 1.3.1. The vulnerability exists in the save_config() function, which handles the punnel_save_config AJAX action. This function lacks proper capability checks (current_user_can()) and nonce verification, allowing authenticated attackers with Subscriber-level access or above to overwrite the plugin's entire configuration, including the API key.

Once an attacker controls the API key, they can exploit the plugin's public API endpoint (sniff_requests() at /?punnel_api=1) to create, update, or delete arbitrary posts, pages, and products on the affected WordPress site.

Critical Impact

Authenticated attackers with minimal privileges (Subscriber-level) can hijack the plugin's API key and gain unauthorized control over WordPress content, enabling arbitrary post manipulation, page defacement, and product modification.

Affected Products

• Punnel – Landing Page Builder plugin for WordPress versions up to and including 1.3.1

Discovery Timeline

• 2026-03-21 - CVE-2026-3645 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3645

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), representing a fundamental security control failure in the plugin's AJAX handling. The save_config() function processes POST requests to admin-ajax.php without verifying whether the requesting user has appropriate administrative capabilities to modify plugin settings. The absence of both capability checks and nonce verification creates a two-fold security weakness that allows any authenticated user to exploit this endpoint.

The attack chain involves two distinct vulnerable components working together. First, the configuration override via the unprotected AJAX action allows attackers to set an arbitrary API key. Second, the public API endpoint at /?punnel_api=1 validates incoming requests solely by comparing a POST token against the stored api_key value—a value the attacker now controls. This effectively grants the attacker full access to content manipulation functions intended only for legitimate API consumers.

Root Cause

The root cause is the absence of authorization controls in the save_config() function located in punnel.php. The function fails to implement WordPress security best practices, specifically omitting current_user_can() checks to verify administrative capabilities and wp_verify_nonce() to prevent cross-site request forgery. This allows any authenticated user, including those with the lowest privilege level (Subscriber), to invoke the AJAX action and modify plugin configuration data.

The vulnerable code can be examined at WordPress Punnel Code Line 118 and related functions at Line 156 and Line 179.

Attack Vector

The attack is network-based and requires only a valid authenticated session with Subscriber-level privileges or higher. An attacker would follow this exploitation flow:

1. Authenticate to the target WordPress site with any valid user account (Subscriber or above)
2. Send a POST request to admin-ajax.php with action=punnel_save_config containing a malicious configuration payload including an attacker-controlled API key
3. Access the public API endpoint at /?punnel_api=1 using the newly set API key as the authentication token
4. Perform unauthorized content operations including creating, modifying, or deleting posts, pages, and WooCommerce products

The public API endpoint validation logic can be reviewed at Line 403 and Line 410 of the plugin source.

Detection Methods for CVE-2026-3645

Indicators of Compromise

• Unexpected changes to the Punnel plugin configuration, particularly the API key setting
• Suspicious POST requests to admin-ajax.php with action=punnel_save_config from non-administrative users
• Unusual activity on the /?punnel_api=1 endpoint, especially requests with unfamiliar API tokens
• Unauthorized creation, modification, or deletion of WordPress posts, pages, or products

Detection Strategies

• Monitor WordPress access logs for POST requests to admin-ajax.php containing action=punnel_save_config from user accounts without administrative privileges
• Implement file integrity monitoring on the plugin's configuration storage to detect unauthorized modifications
• Review WordPress user activity logs for Subscriber-level accounts making administrative API calls
• Set up alerts for unexpected content changes that do not correlate with legitimate editorial activity

Monitoring Recommendations

• Enable comprehensive logging for all AJAX actions targeting the Punnel plugin endpoints
• Configure Web Application Firewall (WAF) rules to flag or block suspicious patterns targeting punnel_save_config
• Implement real-time monitoring of WordPress database tables storing plugin options for the Punnel configuration
• Establish baseline behavior for API endpoint usage and alert on anomalous access patterns

How to Mitigate CVE-2026-3645

Immediate Actions Required

• Disable or deactivate the Punnel – Landing Page Builder plugin until a patched version is available
• Review current plugin configuration and API key settings for any unauthorized modifications
• Audit WordPress user accounts to ensure no unnecessary Subscriber-level accounts exist
• Check WordPress content (posts, pages, products) for any unauthorized changes and restore from backup if necessary
• Consider implementing additional access controls at the web server level to restrict access to admin-ajax.php

Patch Information

At the time of publication, users should monitor the Wordfence Vulnerability Advisory for updates regarding an official patch. Check the WordPress plugin repository for updated versions of Punnel – Landing Page Builder that address this vulnerability by implementing proper capability checks and nonce verification.

Workarounds

• Temporarily disable the Punnel plugin if it is not critical to site operations
• Restrict user registrations and remove unnecessary Subscriber-level accounts to reduce the attack surface
• Implement a WAF rule to block POST requests to admin-ajax.php containing action=punnel_save_config from non-administrative IP addresses or roles
• Use a WordPress security plugin to enforce stricter AJAX action controls and monitor for suspicious activity

# Example: Restrict access to admin-ajax.php for specific actions via .htaccess
# Add to WordPress .htaccess file to block external access to vulnerable endpoint

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$ [NC]
    RewriteCond %{QUERY_STRING} action=punnel_save_config [NC,OR]
    RewriteCond %{REQUEST_METHOD} POST
    RewriteCond %{HTTP:X-WP-Nonce} ^$
    RewriteRule .* - [F,L]
</IfModule>