The vulnerability is a missing authorization flaw in the WPFunnels WordPress plugin that originates from incorrectly configured access‑control security levels. It allows an attacker to bypass intended checks and interact with the plugin’s configuration and management interfaces without proper privilege verification. This corresponds to CWE‑862, a failure to enforce correct authorization in the software.

All releases of the WPFunnels plugin up to and including version 3.6.2 are affected. WordPress sites that have the plugin installed and have not yet applied a corrective update carry the risk. The flaw does not depend on the underlying operating system or host platform; it is confined to the WordPress environment.

The CVSS score of 5.3 indicates a moderate security risk, while the EPSS score of less than 1 % reflects a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote web‑based access to the WordPress admin interface, as the flaw resides in the plugin’s exposed web endpoints. When exploited, an attacker could gain unauthorized control over funnel configuration, potentially exposing sensitive data or enabling subsequent attacks on the site.