CVE-2026-118091: WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPFunnels pluginto a version that resolves this vulnerability.Fixed in 3.13.6
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates it can be exploited remotely over the network without authentication or user interaction. The issue is associated with incorrectly configured access-control security levels.
What is the potential impact?
The reported impact is limited to integrity, meaning an attacker may be able to make unauthorized changes. No confidentiality disclosure or availability impact is indicated by the supplied CVSS vector.
Which versions are affected?
WPFunnels versions through 3.13.5 are affected. The available data does not identify a fixed version.