CVE-2026-79632: CWE-862 Missing Authorization in WPFunnels

The WPFunnels WordPress plugin before version 3.13.0 contains a missing authorization vulnerability in an opt-in submission handler. Specifically, it does not verify the identity or permissions of the requestor, nor does it check for a valid nonce, allowing unauthenticated attackers to specify notification recipients and email subjects arbitrarily. This can be exploited to send emails from the affected site without restriction. The vulnerability is tracked as CVE-2026-79632 and has a CVSS v3.1 base score of 5.3, indicating medium severity. No official patch or remediation guidance is currently documented.

An attacker can send arbitrary emails from the vulnerable WordPress site without authentication, potentially leading to abuse such as spam distribution or phishing campaigns leveraging the trusted domain. There is no direct confidentiality or availability impact reported. The integrity impact is limited to the ability to send unauthorized emails.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the affected opt-in submission handler or restricting access to it via other means such as web application firewall rules or custom code to enforce authorization checks.