# WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.5 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Post Meta Update via Setup Wizard

- **ID:** WPSEC-2026-1903
- **Plugin:** WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell (`wpfunnels`), https://wordpress.org/plugins/wpfunnels/
- **Affected versions:** all versions before 3.13.6
- **Fixed in:** 3.13.6 (Update to 3.13.6 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-352
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpfunnels
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1903/

## Description

The WPFunnels plugin for WordPress is vulnerable to Cross-Site Request Forgery via the setup wizard AJAX actions 'wpfnl_activate_plugin', 'wpfnl_activate_mail_mint' and 'wpfnl_update_step_meta' in all versions up to, and including, 3.13.5, due to missing nonce validation. The plugin activation action also accepts any installed plugin file, and the step meta action writes any meta key and value to any post. This makes it possible for unauthenticated attackers to activate any installed plugin or update arbitrary post meta by tricking a site administrator into performing an action such as clicking a link.

## References

- https://wpsec.com/vuln/WPSEC-2026-1903/
- https://plugins.svn.wordpress.org/wpfunnels/tags/3.13.6/
- https://wordpress.org/plugins/wpfunnels/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1903/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.