CVE-2026-15103
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The WPFunnels plugin for WordPress up to version 3.12.8 is vulnerable to privilege escalation via arbitrary option update. Lack of validation of the `group_id` parameter in the REST API allows attackers with `wpf_manage_funnels` capability to modify the `wp_user_roles` option, enabling them to assign themselves the administrator role.
Risk Assessment
The organization risks full WordPress compromise by an attacker with limited privileges, potentially leading to data theft, defacement, or malware installation.
Recommendation
Immediately update the WPFunnels plugin to version 3.12.9 or later, which includes the fix. Until updated, restrict access to accounts with the `wpf_manage_funnels` capability.
Other vulnerabilities in WPFunnels
See all- CVE-2026-14345Critical
The WPFunnels plugin for WordPress up to version 3.12.7 is vulnerable to Remote Code Execution via the 'postData' parameter. An unauthenticated attacker can write malicious data into a .log file, which is later included via include_once, allowing code execution on the server. Exploitation requires logging to be enabled and an administrator to view the polluted log file.
- CVE-2026-13080Medium
The WPFunnels plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.12.7 via the 'logKey' parameter. Authenticated attackers with administrator-level access can include and execute arbitrary .php files on the server.
- CVE-2026-0626Medium
Stored Cross-Site Scripting (XSS) vulnerability in WordPress WPFunnels plugin up to version 3.7.9. Through the 'wpf_optin_form' shortcode and 'button_icon' parameter, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.
Original NVD description (English source)
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option — which satisfies the route's loose `[\w-]+` regex — to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.