Wpfunnels Funnel Builder For Woocommerce With Checkout One Click Upsell
CVE-2026-15103
|
EUVD-2026-44901
HIGH
GHSA-qq4q-jv8x-6fjm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Privilege escalation in the WPFunnels (Funnel Builder for WooCommerce) plugin for WordPress lets authenticated users holding the wpf_manage_funnels capability — typically the plugin's Funnel Manager custom role — rewrite the global wp_user_roles option and grant their own role full administrator capabilities. All versions up to and including 3.12.8 are affected, and Wordfence rates it CVSS 8.8 (High). No public exploit has been identified at time of analysis, but the root cause is trivial (an unvalidated option name reaching update_option()), making reliable weaponization straightforward for a low-privileged insider.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Wpfunnels Funnel Builder For Woocommerce With Checkout One Click Upsell gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WPFunnels - Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the update_settings() REST callback failing to validate the group_id path parameter against an allowlist of permitted option names before passing it directly to get_option() and update_option(), allowing the built-in wp_user_roles option - which satisfies the route's loose [\w-]+ regex - to be targeted. This makes it possible for authenticated attackers with the wpf_manage_funnels capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the wp_user_roles option, thereby granting any WordPress role full site administrator access. The wpf_manage_funnels capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.
Executive ViewAI
WPFunnels plugin for WordPress (versions ≤3.12.8) contains a privilege escalation vulnerability allowing authenticated users with funnel-manager roles to escalate to full administrator access, compromising entire WordPress installations and sensitive business data. This impacts organizations using WPFunnels for e-commerce or marketing automation, particularly those with distributed administrative access. No vendor patch is available; immediate access restrictions are required to prevent insider threats.
Within 24 hours: Audit all user accounts assigned the wpf_manage_funnels capability and revoke it from non-essential users; document baseline role assignments. Within 7 days: Deploy monitoring to alert on wp_user_roles option modifications via security plugins or database auditing; implement policies restricting funnel-builder role assignment to select administrators. Within 30 days: Evaluate WPFunnels alternatives with granular role-based access controls, engage vendor regarding patch timeline, and prepare contingency to disable WPFunnels if no patch is committed within 60 days.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict wpf_manage_funnels capability to only essential, verified administrators using WordPress role-management plugins; (2) Configure real-time alerts on wp_user_roles database modifications via security monitoring tools; (3) Enforce multi-factor authentication and IP whitelisting for all WordPress administrative accounts; (4) Disable WPFunnels if funnel operations are non-critical until patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Local File Inclusion in the WPFunnels WordPress plugin (all versions through 3.12.7) allows authenticated administrators
Stored cross-site scripting (XSS) in WPFunnels - Easy Funnel Builder plugin for WordPress versions up to 3.7.9 allows au
Price manipulation via missing authorization in WPFunnels plugin for WordPress (all versions ≤3.12.13) lets unauthentica
Exploit-DB