---
id: "CVE-2026-118091"
kind: "vulnerability"
aliases: ["CVE-2026-118091"]
title: "WPFunnels WordPress plugin: missing authorization check through version 3.13.5"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wpfunnels"]
not_affected_if: []
published_at: "2026-10-29T15:17:20+00:00"
first_seen_at: "2026-10-29T15:25:39+00:00"
updated_at: "2026-10-29T15:26:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118091", "first_seen_at": "2026-10-29T15:25:39+00:00"}]
---

# WPFunnels WordPress plugin: missing authorization check through version 3.13.5

The WPFunnels plugin for WordPress has a missing authorization check, which the sources describe as exploiting incorrectly configured access control. Affected versions run through 3.13.5, and the sources do not say what data or actions an attacker could reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed WPFunnels plugin version in the WordPress admin plugin list, or with `wp plugin get wpfunnels --field=version` if WP-CLI is available.
- Compare it against the version range in the sources (through 3.13.5).

## Timeline

- 2026-10-29T15:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118091

## From the sources

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_