CVE-2026-111841: WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Q: What attacker interaction is required to exploit this issue?

An attacker must cause a user to perform an action, as indicated by the User Interaction requirement in the CVSS vector. The issue is network-reachable and does not require attacker privileges.

Q: What is the potential impact if exploitation succeeds?

The CVSS vector indicates high impact to confidentiality, integrity, and availability. The affected component is FunnelKit Automations through version 3.8.5.2.

Published Oct 26, 2026

Updated

Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.

Affected Software

1 affected component

Aman FunnelKit Automations<=3.8.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress FunnelKit Automations to a version that resolves this vulnerability.
Fixed in 3.8.6

Event History

Oct 26, 2026

CVE Published

via MITRE·08:46 AM

Data Sourced

via MITRE·08:46 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What attacker interaction is required to exploit this issue?

An attacker must cause a user to perform an action, as indicated by the User Interaction requirement in the CVSS vector. The issue is network-reachable and does not require attacker privileges.

What is the potential impact if exploitation succeeds?