WPFunnels CVE-2026-118091

The affected product is the WPFunnels WordPress plugin in all versions up to and including 3.13.5. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required against a reachable installation, implying exploitation is possible against default deployments. However, the available sources do not name the specific feature, endpoint, protocol, or configuration setting that triggers the flaw - the trigger is not described in the available sources. The main limiting factor is impact scope: C:N/A:N with only I:L means exploitation yields a limited unauthorized state change, not data disclosure or denial of service. Defenders should treat any internet-facing WordPress site running WPFunnels ≤ 3.13.5 as exposed, while recognizing the confirmed consequence is narrow.

This is a moderate-severity Missing Authorization / broken access control flaw (CWE-862) in the WPFunnels WordPress plugin, rated CVSS 5.3. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) describes remote, low-complexity exploitation with no privileges and no user interaction, but with impact limited to low integrity only (C:N, A:N) - meaning an attacker can likely perform an unauthorized state-changing action rather than read sensitive data or disrupt availability. The vuln.today priority Decision label is 'this_month', which is consistent with a real-but-not-emergency issue: worth remediating in the normal patch cycle rather than a drop-everything response. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and there is no public exploit identified at time of analysis, so there is no public evidence of active exploitation or weaponization. The low integrity-only impact tempers the otherwise alarming network/unauthenticated profile: the raw access vector is broad, but the confirmed consequence is narrow. The exact action an attacker can perform is not described in the single Patchstack reference, so the practical blast radius is unverified.

A remote, unauthenticated attacker sends a crafted HTTP request directly to a WPFunnels plugin endpoint that fails to perform a proper capability/authorization check, carrying out an action that should be restricted to authorized users. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, no special tooling and no victim interaction are required, though the precise trigger and the exact affected action are not described in the available sources. No public exploit identified at time of analysis.