CVE-2026-118088: WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Q: Which installations are affected?

The issue affects WPFunnels versions through 3.13.5. The available data does not identify a safe fixed version.

Q: Does exploitation require authentication or user interaction?

No. The CVSS vector indicates that the vulnerability is remotely exploitable over the network, requires no privileges, and requires no user interaction.

Q: What is the documented impact of successful exploitation?

The CVSS vector indicates an integrity impact only, with no reported confidentiality or availability impact. The description identifies the underlying issue as missing authorization and incorrectly configured access-control levels.

Published Oct 29, 2026

Updated

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WPFunnels plugin to a version that resolves this vulnerability.
Fixed in 3.13.6

Event History

Oct 29, 2026

CVE Published

via MITRE·02:26 PM

Data Sourced

via MITRE·02:26 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The issue affects WPFunnels versions through 3.13.5. The available data does not identify a safe fixed version.

Does exploitation require authentication or user interaction?

No. The CVSS vector indicates that the vulnerability is remotely exploitable over the network, requires no privileges, and requires no user interaction.

What is the documented impact of successful exploitation?

The CVSS vector indicates an integrity impact only, with no reported confidentiality or availability impact. The description identifies the underlying issue as missing authorization and incorrectly configured access-control levels.

CVE-2026-118088: WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or user interaction?

What is the documented impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or user interaction?

What is the documented impact of successful exploitation?