CVE-2026-97269
Received Received - Intake

Unauthenticated IDOR in WPFunnels <= 3.13.1

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Patchstack

Description
Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-97269
EUVD
EUVD-2026-90836

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpfunnels wpfunnels to 3.13.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Unauthenticated Insecure Direct Object References (IDOR) in the WPFunnels WordPress plugin versions 3.13.1 and earlier. It allows attackers to manipulate IDs in URLs to access other users' data without proper authorization.

Detection Guidance

To detect this IDOR vulnerability in WPFunnels <= 3.13.1, manually review URLs for direct object references (e.g., user IDs in query parameters). Test by manipulating IDs in requests to see if unauthorized data access is possible. Check plugin version via WordPress admin panel or database.

Impact Analysis

Attackers could exploit this to access sensitive data belonging to other users, such as personal information or settings, without authentication. This could lead to privacy breaches or unauthorized actions on behalf of other users.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal or health-related data to unauthorized parties. Organizations may face legal penalties or reputational damage due to data breaches.

Mitigation Strategies

Immediately update WPFunnels to version 3.13.2 or later. If auto-update is enabled, verify the update is applied. Disable the plugin temporarily if an update is not immediately available. Monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart