CVE-2026-15103 PUBLISHED

WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter

Assigner: Wordfence
Reserved: 08.07.2026 Published: 16.07.2026 Updated: 16.07.2026

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the update_settings() REST callback failing to validate the group_id path parameter against an allowlist of permitted option names before passing it directly to get_option() and update_option(), allowing the built-in wp_user_roles option — which satisfies the route's loose [\w-]+ regex — to be targeted. This makes it possible for authenticated attackers with the wpf_manage_funnels capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the wp_user_roles option, thereby granting any WordPress role full site administrator access. The wpf_manage_funnels capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor getwpfunnels
Product WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
Versions Default: unaffected
  • affected from 0 to 3.12.8 (incl.)

Credits

  • PRISM finder

References

Problem Types

  • CWE-269 Improper Privilege Management CWE