CVE-2026-118088

CVE-2026-118088 · WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published: 2026-10-29T14:26:27.526Z
Updated: 2026-10-29T16:49:19.530Z

Affected products and versions

wpfunnels
Versions
- ≥ 0, ≤ 3.13.5: Affected; ≥ 3.13.6: Not affected (custom)
Update to 3.13.6

Original sources

https://patchstack.com/database/wordpress/plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-3-13-5-broken-access-control-vulnerability-2?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-118088

Check your server →