CVE case study
CVE-2026-84754: Unauthenticated Broken Access Control in WPFunnels
The WPFunnels WordPress plugin through 3.12.13 exposed a privileged action without a proper capability or nonce check, so an unauthenticated request could invoke it. Version 3.13.0 adds the missing authorization check.
- Weakness
- CWE-862
- Affected
- WPFunnels 3.12.13 and earlier
- Remediation state
- Upgrade to WPFunnels 3.13.0 or later
- Advisory published
- 3 Sep 2026
Why it matters
WPFunnels is a WordPress sales-funnel and marketing-automation plugin. In versions through 3.12.13, one of its actions performed a higher-privilege operation without verifying the caller's capability or a valid nonce, so a request that should have required authorization could be made by an unauthenticated user.
The public record scores the issue Medium at 6.5. Patchstack rates its practical priority as low and notes it is unlikely to be widely exploited, but the missing check still let an unauthenticated actor reach functionality the plugin intended to keep behind an authorization boundary. Version 3.13.0 adds the authorization check the vulnerable path was missing.