🟠 高危 | CVE-2026-15103 — The WPFunnels – Funnel Builder for WooCommerce wit...
🟠 《高危安全漏洞：CVE-2026-15103》
CVSS 评分: 高危（8.8） 状态: Received 发布时间: 2026-07-16
漏洞描述
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the update_settings() REST callback failing to validate the group_id path parameter against an allowlist of permitted option names before passing it directly to get_option() and update_option(), allowing the built-in wp_user_roles option — which satisfies the route's loose [\w-]+ regex — to be targeted. This makes it possible for authenticated attackers with the wpf_manage_funnels capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the wp_user_roles option, thereby granting any WordPress role full site administrator access. The wpf_manage_funnels capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability.
🔍 技术细节
| 字段 | 值 |
|---|---|
| CVE ID | CVE-2026-15103 |
| CVSS 评分 | 8.8 🟠 |
| 严重程度 | 高危 |
| CVSS 向量 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CWE 分类 | CWE-269 |
| 发布时间 | 2026-07-16 |
| 最后更新 | 2026-07-16 |
| 状态 | Received |
| 数据来源 | security@wordfence.com |