Live › vulnerability › CVE-2026-118091
The WPFunnels plugin for WordPress has a missing authorization check, which the sources describe as exploiting incorrectly configured access control. Affected versions run through 3.13.5, and the sources do not say what data or actions an attacker could reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the WPFunnels WordPress plugin at version 3.13.5 or earlier are in the stated range. The sources do not say which configurations or roles make the flaw reachable, so unknown.
No product ranges from the sources yet.
wp plugin get wpfunnels --field=version if WP-CLI is available.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-118091")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.