WPFunnels <= 3.12.8 — Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 3.12.9, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Wordfence PRISM.

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option — which satisfies the route's loose `[\w-]+` regex — to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Jul 15, 2026

   CVE published

   Severity high, CVSS 8.8

2. Nov 13, 2026

   Record last updated