The WordPress plugin WPFunnels allows any user, regardless of authentication status, to trigger the opt‑in submission handler without any nonce or authorisation check. The handler accepts notification recipients and email subject directly from the request, meaning an attacker can send emails to any address with any content. This can be used to spread spam, phishing, or other malicious messages from the host. The weakness is an improper authorisation flaw (CWE‑285).

All WordPress sites running WPFunnels version earlier than 3.13.0 are vulnerable. The vulnerability is present in the wpfnl_shortcode_optin_submission handler of the plugin. No specific WordPress core versions are listed, so any installation of the affected plugin is at risk.

Because no authentication or nonce is required, the attack vector is trivial: anyone can send a crafted request to the vulnerable endpoint. The absence of EPSS data means the current exploitation probability is unknown, but the ability to send arbitrary emails without restriction suggests a high potential impact. The vulnerability is not listed in the CISA KEV catalog, but its ease of exploitation makes it a significant risk for site owners and their users.