# CVE-2026-111841: Aman FunnelKit Automations cross-site request forgery

Source: https://junglewise.ai/threats/cve-2026-111841-cross-site-request-forgery-csrf-vulnerability-in-aman-funnelkit  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-111841 · Severity: high · CVSS 8.8 · Published 2026-10-26

FunnelKit Automations is a WordPress plugin for marketing automation and funnel building. A cross-site request forgery (CSRF) vulnerability allows attackers to trick logged-in administrators into unintended actions such as changing settings or making unauthorized changes. This requires user interaction—for example, clicking a malicious link—but could result in compromise of marketing workflows and data.

Vendors: [Aman](https://junglewise.ai/threats/vendors/aman).

## Quick answers

**Is CVE-2026-111841 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111841 being exploited in the wild.

**How severe is CVE-2026-111841?** High severity, with a CVSS score of 8.8, published 26 October 2026.

**Which products and versions are affected?** Aman FunnelKit Automations through 3.8.5.2.

**Is there a fix for CVE-2026-111841?** Yes: fixed in 3.8.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111841 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111841?** Check whether you run Aman FunnelKit Automations at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.8.6

## Technical details

The vulnerability is a cross-site request forgery in the wp-marketing-automations plugin affecting version 3.8.5.2 and earlier. Exploitation requires a logged-in user (typically an administrator) to be tricked into performing an action on a malicious website or via a crafted link. An attacker can forge requests to modify plugin settings or perform administrative actions without the user's knowledge.

## Affected products

- Aman FunnelKit Automations through 3.8.5.2

## Timeline

- 2026-10-26: disclosed
- 2026-10-26: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-8-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wp-marketing-automations/vulnerability/wordpress-funnelkit-automations-plugin-3-8-5-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve)

## Related threats

- [Aman FunnelKit Automations SQL injection](https://junglewise.ai/threats/cve-2026-111411-improper-neutralization-of-special-elements-used-in-an-sql)