WPFunnels CVE-2026-84754

No authentication is required (PR:N per CVSS vector) and no user interaction is needed (UI:N). The WPFunnels plugin must be installed and active on a WordPress site running version 3.12.13 or earlier. The attack is network-accessible (AV:N), meaning any internet-facing WordPress installation with the plugin active is within reach. Impact is restricted to limited integrity and availability - no confidentiality data is exposed. The specific plugin endpoint or feature subject to the missing authorization check is not named in the available data, which limits defenders' ability to apply targeted endpoint-level controls without consulting the Patchstack advisory.

The CVSS 6.5 (Medium) score reflects a network-accessible, unauthenticated attack requiring no user interaction, with impact limited to integrity and availability (I:L/A:L) - confidentiality is unaffected (C:N) and scope is unaffected (S:U), bounding blast radius to the plugin itself. No EPSS score, KEV listing, or public POC is present in the available data, making real-world exploitation probability difficult to quantify; absent those signals, this reads as a patch-cycle priority rather than emergency response. Even a mid-sized e-commerce operator in inowroclaw running WPFunnels for checkout-funnel management would find the limited I:L/A:L impact warrants prompt scheduled patching but not immediate site shutdown. The 'Authentication Bypass' tag applied in the source data is a loose fit - CWE-862 (Missing Authorization) concerns the absence of permission checks on accessible endpoints, not circumvention of credential verification, which is a distinct class of flaw.

An unauthenticated attacker sends a crafted HTTP request directly to a WPFunnels REST API endpoint or admin-ajax handler that lacks authorization checks. The missing capability verification allows the request to proceed, enabling the attacker to modify or disrupt funnel configuration data without any credentials. No public POC is known, but the low attack complexity (AC:L) and no-interaction (UI:N) nature of the flaw make scripted scanning feasible.