WPFunnels EUVD-2026-112884

Exploitation requires an authenticated WordPress user - in practice an administrator or other privileged user whose session can perform the affected WPFunnels action - to be socially engineered into visiting attacker-controlled content while their session is active (UI:R). The vulnerability stems from missing or insufficient CSRF token (nonce) validation on a WPFunnels request handler; the exact state-changing action is not described in the available sources. Limiting factors: the attack cannot run without victim interaction, it must target a user who is already logged in with sufficient privilege, and it is bounded to a low integrity impact with no confidentiality or availability consequence. Affects WPFunnels versions through 3.13.5; no fixed version is stated in the provided data.

This is a moderate-severity CSRF issue (CVSS 4.3) that in practice sits toward the lower end of real-world urgency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) tells a consistent story: it is network-reachable and requires no attacker-held privileges, but it is gated by user interaction (UI:R) and yields only limited integrity impact with no confidentiality or availability effect. The vuln.today decision label is 'this_month' rather than act_now or emergency, which aligns with that picture. KEV status is not indicated in the input, so there is no evidence of active exploitation. No EPSS score was provided, so exploitation probability cannot be quantified from this data. No working exploit code is shown - the only reference is a Patchstack advisory page, not a verified PoC. The main caveat is that the description is boilerplate ('allows Cross Site Request Forgery') and does not name the affected action or endpoint, so the concrete integrity impact (what state-changing operation can be forged) cannot be confirmed from the available sources and should be verified against the Patchstack advisory.

An attacker crafts a malicious web page or email link and lures a logged-in WordPress user (typically an administrator) of a site running a vulnerable WPFunnels version into visiting it. Because the targeted plugin action lacks CSRF nonce validation, the victim's authenticated browser silently submits the forged state-changing request, producing a limited integrity change. No public exploit code is identified at time of analysis, and the specific forged action is not described in the available sources.