https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:43:56 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2025-15691 <p>The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled.</p> <p>This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.</p> <p>The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled.</p> <p>This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2025-15691 https://vulnerability.circl.lu/vuln/ghsa-23pq-j2qq-jh57 <p>The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled.</p> <p>This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.</p> <p>The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled.</p> <p>This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.</p> https://vulnerability.circl.lu/vuln/ghsa-23pq-j2qq-jh57