WPFunnels WordPress Plugin Unauthorized User Registration Vulnerability

A vulnerability exists in the WPFunnels WordPress plugin, specifically in versions up to and including 3.6.2, allowing unauthorized user registration. The issue arises because the plugin uses a user-controlled value, 'optin_allow_registration', to manage registration permissions, rather than adhering to the site's default settings. This flaw enables unauthenticated attackers to create new user accounts, even when registration is disabled.

Impact

Exploitation of this vulnerability allows for unauthorized user registration, potentially leading to the creation of accounts with elevated privileges, depending on the site's user role management.

Remediation

Users are advised to update the WPFunnels WordPress plugin to version 3.6.3 or a later patched version.