Is CVE-2026-27062 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27062 being exploited in the wild.

How severe is CVE-2026-27062?

Medium severity, with a CVSS score of 4.3, published 29 October 2026.

Which products and versions are affected?

WPFunnels Team WPFunnels up to 3.13.5.

Is there a fix for CVE-2026-27062?

Yes: fixed in 3.13.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27062 attacked?

It is attacked over the network.

Am I affected by CVE-2026-27062?

Check whether you run WPFunnels Team WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27062: WPFunnels cross-site request forgery

CVE-2026-27062 · Severity: medium · CVSS 4.3 · Published 2026-10-29

WPFunnels is a WordPress plugin that helps create sales funnels and marketing workflows. A cross-site request forgery (CSRF) vulnerability allows an attacker to trick logged-in users into performing unintended actions, such as changing settings or making purchases, by visiting a malicious webpage. This affects versions up to 3.13.5, and a fix is available in version 3.13.6 and later.

Technologies: WPFunnels Team WPFunnels. Vendors: WPFunnels Team.

Quick answers

Is CVE-2026-27062 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27062 being exploited in the wild.
How severe is CVE-2026-27062?: Medium severity, with a CVSS score of 4.3, published 29 October 2026.
Which products and versions are affected?: WPFunnels Team WPFunnels up to 3.13.5.
Is there a fix for CVE-2026-27062?: Yes: fixed in 3.13.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27062 attacked?: It is attacked over the network.
Am I affected by CVE-2026-27062?: Check whether you run WPFunnels Team WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.13.6

Technical details

This CSRF vulnerability in WPFunnels allows an unauthenticated attacker to craft a malicious page that, when visited by a logged-in user, triggers unintended administrative or user actions within the plugin. The attack requires user interaction (clicking a link or visiting a crafted page) but no special privileges beyond having an active session. The vulnerability is patched in version 3.13.6.

Affected products

WPFunnels Team WPFunnels up to 3.13.5

Timeline

2026-09-17: disclosed: Reported by mamgad
2026-10-29: advisory: Published by Patchstack

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.