CVE-2026-27062: WordPress WPFunnels plugin <= 3.13.5 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPFunnels pluginto a version that resolves this vulnerability.Fixed in 3.13.6
Event History
Frequently Asked Questions
Which WPFunnels versions are affected?
The issue affects WPFunnels versions through 3.13.5. The available data does not identify a fixed version.
What must an attacker do to exploit this issue?
An attacker must cause a user to interact with a crafted request, as indicated by the required user interaction in the CVSS vector. No attacker privileges are required, and the attack can be delivered over the network.
What is the expected impact of successful exploitation?
Successful exploitation can affect integrity, meaning unauthorized changes may be made through the vulnerable request path. The provided assessment indicates no confidentiality or availability impact.