Security Alert Summary
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin contains a privilege escalation vulnerability that allows an authenticated user with the wpf_manage_funnels capability to update arbitrary WordPress options via a REST callback. An attacker who can reach the vulnerable endpoint can write a crafted role definition into the wp_user_roles option and thereby elevate privileges to administrator.
CVE Details
- CVE ID: CVE-2026-15103
- Affected component: WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell (plugin)
- Affected versions: All versions up to and including 3.12.8
- Published: July 16, 2026 at 09:16:17 AM UTC
- Last modified: July 16, 2026 at 04:19:00 PM UTC
- CVSS v3.1: Base Score 8.8, Severity HIGH, Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: Requires an authenticated user with the
wpf_manage_funnelscapability (minimum). CVSS privileges required: LOW. User interaction: NONE. - Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness (CWE): CWE-269
Technical Details
The vulnerability exists in the plugin’s REST API settings callback update_settings(). That callback fails to validate the group_id path parameter against an allowlist of permitted option names before passing it directly to get_option() and update_option(). The route uses a loose path regex ([\w-]+), which allows the built-in wp_user_roles option to be targeted.
Because update_option() is called with a user-controlled option name that is not validated against an allowlist, an authenticated attacker with the wpf_manage_funnels capability can write a crafted role definition into wp_user_roles. By modifying role capabilities in that option, the attacker can grant administrator-level capabilities to other roles or to themselves, resulting in privilege escalation.
The description identifies the minimum required capability (wpf_manage_funnels) and notes that the Funnel Manager custom role created by the plugin typically has this capability. The issue arises from missing validation checks on the group_id parameter and direct use of WordPress options APIs.
How This Could Impact Your Website
In a typical site scenario, you might have a site owner, several internal staff members (editors or managers), and an external contractor or contributor who helps manage funnels. If a user account with the wpf_manage_funnels capability is compromised or misused, an attacker could elevate privileges to administrator by writing crafted role definitions into the wp_user_roles option.
Practical consequences include unauthorized administrative access, which can lead to viewing or exporting user data (including internal email addresses), installing or activating plugins, changing site content, and creating additional admin accounts. Elevated privileges also increase the risk of targeted phishing or social engineering because an attacker can impersonate trusted internal accounts or access sensitive contact lists.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially custom roles like Funnel Manager or any accounts assigned
wpf_manage_funnels. - Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and restrict plugin management to trusted admin users.
- Monitor site activity and audit logs for unusual behavior, newly created administrator users, or unexpected changes to roles and options.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/core/rest-api/Controllers/class-settings-controller.php#L40
- https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/core/rest-api/Controllers/class-settings-controller.php#L462
- https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/core/rest-api/Controllers/class-settings-controller.php#L66
- https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/utils/class-wpfnl-functions.php#L1216
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3607181%40wpfunnels&new=3607181%40wpfunnels
- https://www.wordfence.com/threat-intel/vulnerabilities/id/76ad6d21-f277-496f-aa6b-f9d5cb8a3801?source=cve
