CVE-2026-3645 Missing authorization in Punnel – Landing Page Builder
Authenticated subscribers can overwrite plugin settings and API keys, allowing them to modify site content via the public API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3645?
CVE-2026-3645 is a medium-severity missing authorization vulnerability in Punnel – Landing Page Builder, published on 21 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1. The save_config() function, which handles the 'punnel_save_config' AJAX action, lacks any capability check (current_user_can()) and nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the plugin's entire configuration including the API key via a POST request to admin-ajax.php. Once the API key is known (because the attacker set it), the attacker can use the plugin's public API endpoint (sniff_requests() at /?punnel_api=1) — which only validates requests by comparing a POST token against the stored api_key — to create, update, or delete arbitrary posts, pages, and products on the site.
Weakness: CWE-862
Which versions are affected by CVE-2026-3645?
How do I fix CVE-2026-3645?
No fix has been published for CVE-2026-3645 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-3645 being exploited?
There is no known exploitation of CVE-2026-3645 in the wild and no public exploit code.
Sources
Also known as GHSA-p6xf-h6c6-2mx9.