FunnelKit Automations CVE-2026-111841

Exploitation requires a victim who is already authenticated to the target WordPress site with sufficient privileges over FunnelKit Automations (typically an administrator or plugin operator) to be tricked into visiting attacker-controlled content while that session is active (UI:R). The attack is defeated by the normal WordPress nonce mechanism, so it only works against plugin actions that fail to validate a CSRF token; the specific vulnerable feature, endpoint, or configuration is not described in the available sources. Limiting factors: the mandatory user interaction and the need for a logged-in privileged victim mean this cannot be exploited against an unauthenticated or idle target, and no special non-default configuration is indicated as required.

This is a CWE-352 Cross-Site Request Forgery flaw in the FunnelKit Automations WordPress plugin (≤ 3.8.5.2), scored CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and reported by Patchstack with a vuln.today priority of 'this_week'. The signals are partially conflicting and partially absent. On the one hand, the CVSS vector is network-reachable with low complexity and no attacker-held privileges (PR:N, standard for CSRF since the privilege is supplied by the tricked victim) and claims High impact to confidentiality, integrity and availability. On the other hand, the mandatory UI:R requirement means a logged-in user must be socially engineered into visiting attacker content, which materially lowers real-world exploitability compared with a no-interaction RCE. There is no CISA KEV listing, no EPSS probability supplied, and no confirmed public exploit in the input, so there is no evidence of active or widespread exploitation - the 8.8 is a severity ceiling, not an exploitation-likelihood signal. Critically, the description does not state which plugin action the CSRF triggers, so the C:H/I:H/A:H impact rating is Patchstack's assumption rather than an evidenced fact; the true impact cannot be verified from the available sources. Net: a genuine, patch-worthy issue warranting remediation on the vendor's/triage 'this_week' cadence, but not an emergency given the user-interaction gate and absence of any exploitation evidence.

An attacker crafts a malicious web page or email containing a forged request targeting a FunnelKit Automations endpoint and lures a currently authenticated WordPress user (typically an administrator) into opening it. Because the vulnerable action lacks proper anti-CSRF nonce validation, the victim's browser submits the request with their valid session, performing a state-changing operation without consent. The specific triggered action is not described in the available sources, and no confirmed working exploit code is listed - only a Patchstack database reference.