# CVE-2026-15103: WPFunnels privilege escalation via arbitrary option update

Source: https://junglewise.ai/threats/cve-2026-15103-wpfunnels-privilege-escalation-via-arbitrary-option-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-15103 · Severity: high · CVSS 8.8 · Published 2026-07-16

WPFunnels, a WordPress plugin used to create sales funnels and checkout processes for WooCommerce, contains a security flaw that allows certain authorized users to gain full administrative control over the website. By exploiting this vulnerability, a user with limited 'Funnel Manager' permissions can rewrite site settings to grant themselves or others unrestricted access. This could lead to a total site takeover, data theft, or complete service disruption.

Technologies: [WPFunnels](https://junglewise.ai/threats/technologies/wpfunnels). Vendors: [WPFunnels](https://junglewise.ai/threats/vendors/wpfunnels).

## Quick answers

**Is CVE-2026-15103 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15103 being exploited in the wild.

**How severe is CVE-2026-15103?** High severity, with a CVSS score of 8.8, published 16 July 2026.

**Which products and versions are affected?** WPFunnels up to, and including, 3.12.8.

**Is there a fix for CVE-2026-15103?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15103 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-15103?** Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `update_settings()` REST callback due to a lack of validation on the `group_id` path parameter. The callback fails to check the parameter against an allowlist before passing it to `update_option()`, and the associated route uses a loose regex (`[\w-]+`) that matches the core WordPress `wp_user_roles` option. An authenticated attacker with the `wpf_manage_funnels` capability (typically the 'Funnel Manager' role) can send a crafted request to overwrite the site's role definitions. By injecting arbitrary capabilities into a role, the attacker can elevate their privileges to Administrator. A patch was released in version 3.12.9.

## Affected products

- getwpfunnels WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell up to, and including, 3.12.8

## Timeline

- 2026-07-16: disclosed
- 2026-07-16: advisory

## References

- [https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/core/rest-api/Controllers/class-settings-controller.php](https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/core/rest-api/Controllers/class-settings-controller.php)
- [https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/core/rest-api/Controllers/class-settings-controller.php](https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/core/rest-api/Controllers/class-settings-controller.php)
- [https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/core/rest-api/Controllers/class-settings-controller.php](https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/core/rest-api/Controllers/class-settings-controller.php)
- [https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/utils/class-wpfnl-functions.php](https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.8/includes/utils/class-wpfnl-functions.php)
- [https://plugins.trac.wordpress.org/changeset?reponame=&old=3607181%40wpfunnels&new=3607181%40wpfunnels](https://plugins.trac.wordpress.org/changeset?reponame=&old=3607181%40wpfunnels&new=3607181%40wpfunnels)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/76ad6d21-f277-496f-aa6b-f9d5cb8a3801?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/76ad6d21-f277-496f-aa6b-f9d5cb8a3801?source=cve)

## Related threats

- [WPFunnels missing authorization in AJAX payment handler](https://junglewise.ai/threats/cve-2026-84908-wpfunnels-missing-authorization-in-ajax-payment-handler)
- [WPFunnels plugin unauthenticated arbitrary email sending in opt-in handler](https://junglewise.ai/threats/cve-2026-79632-wpfunnels-plugin-unauthenticated-arbitrary-email-sending-in-opt)
- [WPFunnels WordPress plugin information disclosure via web-accessible logs](https://junglewise.ai/threats/cve-2026-79631-wpfunnels-wordpress-plugin-information-disclosure-via-web)
- [WPFunnels checkout order bump product substitution allowing price manipulation](https://junglewise.ai/threats/cve-2026-79630-wpfunnels-checkout-order-bump-product-substitution-allowing-price)
- [WPFunnels WordPress plugin unauthenticated user registration bypass](https://junglewise.ai/threats/cve-2025-15691-wpfunnels-wordpress-plugin-unauthenticated-user-registration)