CyberRota Analysis
AI-GeneratedThe WPFunnels WordPress plugin prior to version 3.13.0 is vulnerable as it allows unauthenticated attackers to create user accounts through opt-in form submissions, bypassing the site's user registration settings. This can lead to unauthorized access and potential exploitation of the WordPress site. WordPress administrators using this plugin should prioritize updating to version 3.13.0 to mitigate this risk.
Original NVD Description
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled. This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.