Live › vulnerability › CVE-2026-27062
WPFunnels, a WordPress plugin for sales funnels, has a cross-site request forgery flaw affecting versions through 3.13.5. An attacker can trick a logged-in administrator's browser into sending requests the plugin accepts without proper checks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
Sites running the WPFunnels plugin at or below 3.13.5 are exposed, since the plugin's requests can be forged from another website visited by a logged-in user. Sites without WPFunnels installed are not affected. The sources do not say which specific actions are forgeable or whether the flaw needs a particular role.
No product ranges from the sources yet.
wp plugin get wpfunnels --field=version3.13.5)No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-27062")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.