{"id":"CVE-2026-118091","kind":"vulnerability","aliases":["CVE-2026-118091"],"related":[],"title":"WPFunnels WordPress plugin: missing authorization check through version 3.13.5","description":"Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.","summary":"The WPFunnels plugin for WordPress has a missing authorization check, which the sources describe as exploiting incorrectly configured access control. Affected versions run through 3.13.5, and the sources do not say what data or actions an attacker could reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wpfunnels"],"not_affected_if":[],"how_to_check":"- Check the installed WPFunnels plugin version in the WordPress admin plugin list, or with `wp plugin get wpfunnels --field=version` if WP-CLI is available.\n- Compare it against the version range in the sources (through 3.13.5).","fix":null,"status":"open","published_at":"2026-10-29T15:17:20+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","triaged_at":"2026-10-29T15:26:55+00:00","updated_at":"2026-10-29T15:26:55+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-29T15:26:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WPFunnels WordPress plugin: missing authorization check through version 3.13.5","impact":"medium","summary":"The WPFunnels plugin for WordPress has a missing authorization check, which the sources describe as exploiting incorrectly configured access control. Affected versions run through 3.13.5, and the sources do not say what data or actions an attacker could reach.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpfunnels"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown: sources do not say what an attacker can reach","analyst_note":"Find the vendor advisory or Wordfence/NVD detail for CVE-2026-118091 to confirm the affected endpoint, required role, and a fixed version.","how_to_check":"- Check the installed WPFunnels plugin version in the WordPress admin plugin list, or with `wp plugin get wpfunnels --field=version` if WP-CLI is available.\n- Compare it against the version range in the sources (through 3.13.5).","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites running the WPFunnels WordPress plugin at version 3.13.5 or earlier are in the stated range. The sources do not say which configurations or roles make the flaw reachable, so unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000677,"input_tokens":4121,"output_tokens":530,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118091':12A,15A '-2026':11A,14A '3.13.5':9A,43B,80C 'access':37B,70C 'action':53B 'affect':39B,75C 'allow':66C 'attack':55B 'author':5A,27B,59C 'check':6A,28B 'configur':36B,69C 'control':38B,71C 'could':56B 'cve':10A,13A 'data':51B 'describ':32B 'exploit':34B,67C 'incorrect':35B,68C 'issu':74C 'levels.this':73C 'miss':4A,26B,58C 'n/a':78C 'packag':16B 'plugin':3A,21B 'reach':57B 'run':41B 'say':49B 'secur':72C 'sourc':31B,46B 'team':63C 'version':8A,40B 'vulner':60C 'wordpress':2A,17B,23B 'wpfunnel':1A,18B,20B,62C,64C,65C,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WPFunnels WordPress plugin at version 3.13.5 or earlier are in the stated range. The sources do not say which configurations or roles make the flaw reachable, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T15:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118091","severity":null,"published_at":"2026-10-29T15:17:20+00:00","modified_at":"2026-10-29T15:18:54+00:00","first_seen_at":"2026-10-29T15:25:39+00:00","fetched_at":"2026-10-29T15:25:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}