Skip to content
Threat Feed
Subscribe

Vendor

WPFunnels

2 briefs RSS
critical advisory

WPFunnels Plugin Privilege Escalation via Arbitrary Option Update

Authenticated attackers with the `wpf_manage_funnels` capability can exploit CVE-2026-15103, a privilege escalation vulnerability in the `update_settings()` REST callback of the WPFunnels - Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress (versions up to and including 3.12.8), allowing them to gain full site administrator access by injecting a crafted role definition into the `wp_user_roles` option.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin privilege-escalation wordpress plugin
1r 1t 1c
critical advisory

CVE-2026-14345: Unauthenticated Remote Code Execution in WPFunnels WordPress Plugin

An unauthenticated remote code execution vulnerability (CVE-2026-14345) exists in the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress, affecting versions up to and including 3.12.7, allowing attackers to inject malicious PHP code into a log file via the 'postData' parameter, which is then executed when an administrator views the log.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin <= 3.12.7 web-exploit rce wordpress plugin-vulnerability
2t 1c