CVE-2026-3645 describes a missing authorization vulnerability (CWE-862) in the Punnel – Landing Page Builder WordPress plugin, versions up to 1.3.1. The save_config() function, which processes the 'punnel_save_config' AJAX action, does not perform any capability checks (such as current_user_can()) nor nonce verification. This flaw allows any authenticated user with Subscriber-level privileges or higher to send a POST request to admin-ajax.php to overwrite the entire plugin configuration, including the API key. Once the attacker controls the API key, they can exploit the plugin's public API endpoint (/punnel_api=1) to manipulate site content by creating, updating, or deleting posts, pages, and products. The vulnerability is network exploitable with low attack complexity and no user interaction required, but it requires at least authenticated access.

An attacker with at least Subscriber-level access can overwrite the plugin's configuration and set a malicious API key. Using this key, the attacker can leverage the plugin's public API to modify site content arbitrarily, including creating, updating, or deleting posts, pages, and products. This can lead to unauthorized content manipulation and potential site integrity compromise. There is no indication of impact on confidentiality or availability, and no known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only, as the vulnerability requires authenticated access at Subscriber level or higher. Monitor plugin updates from the vendor and apply any official patches promptly once released.