The vulnerability is an unauthenticated broken access control flaw in the WordPress WPFunnels plugin, affecting all releases up to and including 3.12.13. According to the description, certain administrative or funnel‑related endpoints appear to lack proper authorization checks, which means that an unauthenticated attacker could potentially exploit these weaknesses to perform unauthorized actions. The flaw is categorized as CWE‑862. The potential impact includes unauthorized modification of funnels and exposure of sensitive data handled by the plugin.

The affected systems are WordPress sites that have the WPFunnels plugin installed at any version up to 3.12.13. Site administrators should verify their installed version and upgrade if it is below 3.13.0, as newer releases have fixed the authorization checks.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not currently available, so the known exploitation probability cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that because authentication is not required, an unauthenticated attacker could direct crafted requests to the plugin’s endpoints. The risk is therefore realistic if the site is publicly reachable and the plugin is installed. Immediate action to remove or patch the vulnerable code is recommended to prevent privilege escalation or data exposure.