The Punnel – Landing Page Builder plugin has a missing authorization check in its AJAX handler for saving configuration. Because the function does not enforce capability checks or nonce verification, any authenticated user with Subscriber level or higher can send a POST request to the admin‑ajax.php endpoint and overwrite the plugin’s entire configuration, including the stored API key. This flaw is identified as CWE-862, Missing Authorization, and allows attackers to take full control of the public API used by the plugin. Once the API key is compromised, the attacker can use the public API endpoint to create, modify, or delete posts, pages, and product listings on the site without further authentication.

All WordPress sites that have the Punnel – Landing Page Builder plugin version 1.3.1 or earlier are affected. The vulnerability resides in the plugin’s core file and is not dependent on site settings beyond the presence of the plugin and an authenticated user with at least Subscriber privileges.

The CVSS score of 5.3 classifies the vulnerability as moderate. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. The attack vector is remote, requiring only an authenticated web session. An attacker can send a crafted POST request to /wp-admin/admin‑ajax.php with the action punnel_save_config, bypassing the missing security checks. After setting the API key, the attacker can exploit the unsecured public API to manipulate content on the site.