CVE-2026-120853 · Package
NO FIX YET
CartFlows, a WordPress plugin for sales funnels, has a missing authorization check that lets some users reach functions they should not. The sources describe it as an access control misconfiguration in versions through 3.3.0.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the CartFlows WordPress plugin at version 3.3.0 or earlier are in the affected range according to the sources. The sources do not describe which roles or settings make a site reachable, so the exact exposure is unknown.
Not affected if cartflows-not-installed
Who cares cartflows, self-hosted, wordpress
wp plugin get cartflows --field=versionNo fix yet, per the sources.
Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through 3.3.0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.