The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin contains a flaw in its REST API endpoint that allows the caller to send a "group_id" path parameter without proper validation, a classic example of CWE-269 (Improper Restriction of Privileges). Because the value can match the "wp_user_roles" WordPress option, an authenticated user possessing the wpf_manage_funnels capability can overwrite this option with a crafted role definition that grants any desired capability set, including administrator rights. An attacker who can then elevate privileges to administrator can take full control of the site, exfiltrate data, or cause service disruption.

The vulnerability affects all installations of the WPFunnels plugin for WordPress up to and including version 3.12.8. The affected product is the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin developed by getwpfunnels.

The CVSS score of 8.8 places this issue in the high severity range, indicating that it can be leveraged to gain complete administrative access. The EPSS score of less than 1% suggests that, while public exploitation is currently rare, the risk is not zero, especially in environments where the wpf_manage_funnels role exists. The vulnerability is not listed in CISA KEV, but the impact remains severe. The attack vector requires authentication; an attacker must hold a role that includes the wpf_manage_funnels capability, which is normally granted to the Funnel Manager role created by the plugin.