Is CVE-2026-104386 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104386 being exploited in the wild.

How severe is CVE-2026-104386?

Medium severity, with a CVSS score of 6.5, published 5 October 2026.

Which products and versions are affected?

WPFunnels Team WP VR through 9.1.3.

Is there a fix for CVE-2026-104386?

Yes: fixed in 9.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104386 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104386?

Check whether you run WPFunnels Team WP VR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104386: WPFunnels WP VR broken access control

CVE-2026-104386 · Severity: medium · CVSS 6.5 · Published 2026-10-05

WP VR is a WordPress plugin used by WPFunnels Team for website functionality. A broken access control vulnerability allows contributors and developers to bypass authorization checks and access or perform actions they should not be permitted, such as viewing other users' data or modifying restricted content. An attacker with contributor or developer privileges could exploit this to access sensitive information or compromise site integrity.

Vendors: WPFunnels Team.

Quick answers

Is CVE-2026-104386 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104386 being exploited in the wild.
How severe is CVE-2026-104386?: Medium severity, with a CVSS score of 6.5, published 5 October 2026.
Which products and versions are affected?: WPFunnels Team WP VR through 9.1.3.
Is there a fix for CVE-2026-104386?: Yes: fixed in 9.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104386 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104386?: Check whether you run WPFunnels Team WP VR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 9.1.4

Technical details

This is a broken access control vulnerability (CWE-639) in the WP VR WordPress plugin affecting versions through 9.1.3. The vulnerability requires a user with Contributor or Developer role to perform a malicious action such as clicking a link or visiting a crafted page; exploitation allows bypassing permission checks to access or modify restricted resources. A patch is available in version 9.1.4.

Affected products

WPFunnels Team WP VR through 9.1.3

Timeline

2026-09-15: disclosed: Reported by Zac Lou
2026-10-05: advisory: Published by Patchstack
2026-10-05: patched: Fix available in version 9.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.