Is CVE-2026-15103 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15103 being exploited in the wild.

How severe is CVE-2026-15103?

High severity, with a CVSS score of 8.8, published 16 July 2026.

Which products and versions are affected?

WPFunnels up to, and including, 3.12.8.

Is there a fix for CVE-2026-15103?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15103 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-15103?

Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15103: WPFunnels privilege escalation via arbitrary option update

CVE-2026-15103 · Severity: high · CVSS 8.8 · Published 2026-07-16

WPFunnels, a WordPress plugin used to create sales funnels and checkout processes for WooCommerce, contains a security flaw that allows certain authorized users to gain full administrative control over the website. By exploiting this vulnerability, a user with limited 'Funnel Manager' permissions can rewrite site settings to grant themselves or others unrestricted access. This could lead to a total site takeover, data theft, or complete service disruption.

Technologies: WPFunnels. Vendors: WPFunnels.

Quick answers

Is CVE-2026-15103 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15103 being exploited in the wild.
How severe is CVE-2026-15103?: High severity, with a CVSS score of 8.8, published 16 July 2026.
Which products and versions are affected?: WPFunnels up to, and including, 3.12.8.
Is there a fix for CVE-2026-15103?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15103 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-15103?: Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `update_settings()` REST callback due to a lack of validation on the `group_id` path parameter. The callback fails to check the parameter against an allowlist before passing it to `update_option()`, and the associated route uses a loose regex (`[\w-]+`) that matches the core WordPress `wp_user_roles` option. An authenticated attacker with the `wpf_manage_funnels` capability (typically the 'Funnel Manager' role) can send a crafted request to overwrite the site's role definitions. By injecting arbitrary capabilities into a role, the attacker can elevate their privileges to Administrator. A patch was released in version 3.12.9.

Affected products

getwpfunnels WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell up to, and including, 3.12.8

Timeline

2026-07-16: disclosed
2026-07-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.