{"id":"CVE-2026-111841","kind":"vulnerability","aliases":["CVE-2026-111841"],"related":[],"title":"FunnelKit Automations WordPress plugin: CSRF flaw up to 3.8.5.2","description":"Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.","summary":"FunnelKit Automations (wp-marketing-automations), a WordPress marketing plugin, has a cross-site request forgery flaw in versions through 3.8.5.2. A logged-in administrator who visits a malicious page could be tricked into making unwanted changes on the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["marketing-automation","package","wordpress","wp-plugin"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the FunnelKit Automations plugin (wp-marketing-automations) in the WordPress admin Plugins screen, or with `wp plugin get wp-marketing-automations --field=version` using WP-CLI.","fix":"- Update FunnelKit Automations to a version newer than `3.8.5.2`; the fixed version is unknown from the sources.","status":"open","published_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","triaged_at":"2026-10-26T09:30:48+00:00","updated_at":"2026-10-26T09:30:48+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T09:30:48Z","model":"claude-haiku-5-5","output":{"fix":"- Update FunnelKit Automations to a version newer than `3.8.5.2`; the fixed version is unknown from the sources.","reach":"internet","title":"FunnelKit Automations WordPress plugin: CSRF flaw up to 3.8.5.2","impact":"medium","summary":"FunnelKit Automations (wp-marketing-automations), a WordPress marketing plugin, has a cross-site request forgery flaw in versions through 3.8.5.2. A logged-in administrator who visits a malicious page could be tricked into making unwanted changes on the site.","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","marketing-automation"],"confidence":0.5,"needs_auth":"yes","worst_case":"Logged-in admin actions are performed without consent, changing plugin settings or data","analyst_note":"Confirm the fixed version and the specific actions reachable via CSRF from the vendor advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111841.","how_to_check":"- Check the installed version of the FunnelKit Automations plugin (wp-marketing-automations) in the WordPress admin Plugins screen, or with `wp plugin get wp-marketing-automations --field=version` using WP-CLI.","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running FunnelKit Automations at version 3.8.5.2 or earlier are affected. The risk depends on logged-in administrators or editors who can be lured to a malicious page while signed in. Sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000633,"input_tokens":3318,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111841':12A,15A '-2026':11A,14A '3.8.5.2':9A,45B,93C 'administr':50B 'affect':87C 'allow':81C 'aman':74C 'autom':2A,18B,25B,29B,76C,80C,89C 'chang':62B 'could':56B 'cross':37B,67C,82C 'cross-sit':36B,66C 'csrf':5A,71C 'cve':10A,13A 'flaw':6A,41B 'forgeri':40B,70C 'forgery.this':85C 'funnelkit':1A,24B,75C,88C 'issu':86C 'log':48B 'logged-in':47B 'make':60B 'malici':54B 'market':17B,28B,32B,79C 'marketing-autom':16B 'n/a':91C 'packag':19B 'page':55B 'plugin':4A,23B,33B 'request':39B,69C,84C 'site':38B,65B,68C,83C 'trick':58B 'unwant':61B 'version':43B 'visit':52B 'vulner':72C 'wordpress':3A,20B,31B 'wp':22B,27B,78C 'wp-marketing-autom':26B,77C 'wp-plugin':21B","nicknames":[],"mitigations":[],"who_affected":"Sites running FunnelKit Automations at version 3.8.5.2 or earlier are affected. The risk depends on logged-in administrators or editors who can be lured to a malicious page while signed in. Sites without this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T09:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111841","severity":null,"published_at":"2026-10-26T09:16:34+00:00","modified_at":"2026-10-26T09:16:34+00:00","first_seen_at":"2026-10-26T09:29:15+00:00","fetched_at":"2026-10-26T09:29:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}