Live › vulnerability › CVE-2026-118088
WPFunnels is a WordPress plugin for building sales funnels. A missing authorization check lets a user perform actions their role should not allow, according to the advisory text.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the WPFunnels WordPress plugin at version 3.13.5 or earlier are listed as affected. The sources do not say which roles or settings are required to reach the flaw.
No product ranges from the sources yet.
3.13.5 or earlier.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-118088")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.