CVE-2025-12353 is an authorization bypass vulnerability in the WPFunnels plugin for WordPress and WooCommerce. The plugin relies on a user-controllable key 'optin_allow_registration' to determine whether user registration is allowed, rather than enforcing the site-specific registration configuration. This design flaw permits unauthenticated attackers to create new user accounts despite user registration being disabled in the site settings. The vulnerability affects all versions up to and including 3.6.2. There is no vendor advisory or patch information currently available.

An attacker can bypass the intended user registration restrictions and create unauthorized user accounts on the affected WordPress site. This could lead to unauthorized access or privilege escalation depending on the roles assigned to newly created accounts. The vulnerability does not directly impact confidentiality or availability but can lead to integrity issues by allowing unauthorized user creation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or restricting access to the WPFunnels plugin functionality or monitoring for suspicious user registrations. Avoid relying solely on the plugin's registration controls and consider additional access controls at the WordPress level.