CVE-2026-118091

CVE-2026-118091 · WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published: 2026-10-29T14:23:51.139Z
Updated: 2026-10-30T18:50:06.004Z

Affected products and versions

wpfunnels
Versions
- ≥ 0, ≤ 3.13.5: Affected; ≥ 3.13.6: Not affected (custom)
Update to 3.13.6

Original sources

https://patchstack.com/database/wordpress/plugin/wpfunnels/vulnerability/wordpress-wpfunnels-plugin-3-13-5-broken-access-control-vulnerability?_s_id=cve
https://nvd.nist.gov/vuln/detail/CVE-2026-118091

Check your server →