The WPFunnels WordPress plugin before version 3.13.0 fails to perform any authorization or nonce check in its opt‑in submission handler, permitting any requester to trigger the handler. The handler accepts notification recipients and subject directly from the HTTP request, enabling a sender to instruct the site to dispatch emails to any address with any content. This flaw, identified as an improper access control weakness (CWE‑862), can be leveraged to send spam, phishing, or malicious messages from the host. The impact is the potential use of the site as an unsolicited mail relay, compromising the site's reputation and possibly violating anti‑spam regulations.

WordPress installations running WPFunnels plugin versions earlier than 3.13.0 are affected. The vulnerability resides in the wpfnl_shortcode_optin_submission endpoint; no specific WordPress core versions are required for exploitation.

The attacker can invoke the vulnerable endpoint without authentication, so the attack vector is effectively a publicly accessible HTTP request. The CVSS score of 5.3 indicates moderate severity. EPSS shows less than 1% probability of exploitation in the wild, yet the ability to send arbitrary email content raises the risk of spam or phishing campaigns. The vulnerability is not currently listed in the CISA KEV catalog, but its simplicity makes it a notable threat for site owners.