{
 "id": "WPSEC-2026-1903",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1903/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1903/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1903/index.md",
 "title": "WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Post Meta Update via Setup Wizard",
 "description": "The WPFunnels plugin for WordPress is vulnerable to Cross-Site Request Forgery via the setup wizard AJAX actions 'wpfnl_activate_plugin', 'wpfnl_activate_mail_mint' and 'wpfnl_update_step_meta' in all versions up to, and including, 3.13.5, due to missing nonce validation. The plugin activation action also accepts any installed plugin file, and the step meta action writes any meta key and value to any post. This makes it possible for unauthenticated attackers to activate any installed plugin or update arbitrary post meta by tricking a site administrator into performing an action such as clicking a link.",
 "plugin": {
  "slug": "wpfunnels",
  "name": "WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell",
  "full_name": "WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell",
  "wordpress_org": "https://wordpress.org/plugins/wpfunnels/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpfunnels/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpfunnels"
 },
 "type": "CSRF",
 "cwe": [
  "CWE-352"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.13.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.13.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.13.6",
 "remediation": "Update to 3.13.6 or later.",
 "fix_released": "2026-10-28T06:05:57+00:00",
 "published": "2026-10-29T06:44:57+00:00",
 "updated": "2026-10-28T09:20:08.739060+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1903/",
  "https://plugins.svn.wordpress.org/wpfunnels/tags/3.13.6/",
  "https://wordpress.org/plugins/wpfunnels/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpfunnels",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}