Vulnerabilities / WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell / WPSEC-2026-1903
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Post Meta Update via Setup Wizard
Medium 4.3
CWE-352Fixed in 3.13.6
- ID
- WPSEC-2026-1903
- Plugin
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell (wpfunnels)
- Affected
- all versions before 3.13.6
- Remediation
- Update to 3.13.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-352
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell on WPSec AttackSurface
- Fix released
- Published
Description
The WPFunnels plugin for WordPress is vulnerable to Cross-Site Request Forgery via the setup wizard AJAX actions 'wpfnl_activate_plugin', 'wpfnl_activate_mail_mint' and 'wpfnl_update_step_meta' in all versions up to, and including, 3.13.5, due to missing nonce validation. The plugin activation action also accepts any installed plugin file, and the step meta action writes any meta key and value to any post. This makes it possible for unauthenticated attackers to activate any installed plugin or update arbitrary post meta by tricking a site administrator into performing an action such as clicking a link.
References
- https://wpsec.com/vuln/WPSEC-2026-1903/
- https://plugins.svn.wordpress.org/wpfunnels/tags/3.13.6/
- https://wordpress.org/plugins/wpfunnels/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS