WordPress WPFunnels Plugin Privilege Escalation via Unvalidated Options

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option — which satisfies the route's loose `[\w-]+` regex — to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WPFunnels plugin for WordPress contains a critical privilege escalation vulnerability in its REST API settings callback that fails to validate the `group_id` parameter before using it to update WordPress options. An unauthenticated or low-privileged attacker can exploit this flaw to modify the `wp_user_roles` option, effectively granting themselves administrative capabilities without proper authorization. This affects all versions up to 3.12.8 of a widely-used WooCommerce funnel builder plugin, putting thousands of e-commerce sites at risk of account takeover and complete site compromise.

Casky's 224 mapped security skills—powered by Claude AI's extended reasoning across MITRE ATT&CK framework—would detect this vulnerability as part of Privilege Escalation (TA0004) detection patterns. A practitioner using Casky would identify suspicious REST API calls to the settings endpoint with anomalous `group_id` parameters pointing to sensitive WordPress options like `wp_user_roles`, coupled with subsequent changes to user role metadata. The platform's skill mapping would correlate these API behaviors with CWE-269 (Improper Access Control) indicators, flag the missing input validation on path parameters, and surface evidence of role/capability modifications in WordPress audit logs—enabling defenders to spot exploitation attempts in real-time before attackers establish persistence through elevated privileges.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15103.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-15103

Casky has 224 skills that investigate the attack patterns behind CVE-2026-15103. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn