WPFunnels CVE-2026-118088

The affected WPFunnels plugin (versions from n/a through 3.13.5) must be installed and active on a network-reachable WordPress site. The CVSS vector (PR:N/UI:N) indicates no authentication and no user interaction are required, so the limiting factors are chiefly the plugin's presence and version (<=3.13.5) rather than any special configuration. The description references 'Incorrectly Configured Access Control Security Levels' but does not name the specific endpoint, feature, or setting that is unprotected, so the precise trigger is not described in the available sources. The practical limit on impact is the CVSS integrity-only, LOW rating (C:N/I:L/A:N): exploitation yields a bounded unauthorized modification, not data disclosure or denial of service.

This is a moderate, not urgent, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a remotely reachable, low-complexity, unauthenticated flaw whose only impact is a LOW hit to integrity - no confidentiality or availability loss and no scope change. That impact ceiling is the single most important risk signal: a missing-authorization (CWE-862) bug here lets an unauthenticated actor reach a protected action and make a limited, unauthorized modification, not take over the site. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with a medium-severity, integrity-only plugin bug. Key decision signals are MISSING and must not be invented: no EPSS score was provided, the CVE is NOT on the CISA KEV list, and the only reference is a Patchstack advisory (no public exploit or PoC code provided). Exploitation status is therefore 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description - both point to unauthenticated network access with limited integrity impact. The main caveat is that the description is generic ('Exploiting Incorrectly Configured Access Control Security Levels') and does not name the specific endpoint or action affected, so the concrete exploitable capability cannot be pinned down from the supplied data.

An unauthenticated remote attacker sends a crafted web request directly to a WPFunnels plugin endpoint that fails to verify the caller's authorization, invoking a protected action without logging in. Because the impact is limited to integrity (C:N/I:L/A:N), the attacker can make an unauthorized but bounded modification rather than read sensitive data or disrupt the site. No public exploit or PoC code was supplied; the only reference is a Patchstack advisory.