Medium severity5.3NVD Advisory· Published Sep 4, 2026· Updated Sep 8, 2026
CVE-2026-79632
CVE-2026-79632
Description
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
2- Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)Wordfence Blog · Sep 10, 2026
- WordPress Plugins: 25 Vulnerabilities Disclosed in Batch, Ranging from Critical to Medium SeverityVypr Intelligence · Sep 4, 2026