Cross-Site Request Forgery Vulnerability in Aman FunnelKit Automations by WordPress
CVE-2026-111841

8.8HIGH

Key Information:

Vendor

WordPress
Status
Funnelkit Automations
Vendor
CVE Published:
26 October 2026

What is CVE-2026-111841?

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Aman FunnelKit Automations plugin for WordPress. This issue allows unauthorized commands to be transmitted from a user that the web application trusts. By exploiting this flaw, attackers can potentially perform actions on behalf of unsuspecting users, leading to unauthorized changes or data leakage. The vulnerable versions range from not applicable to 3.8.5.2, making it crucial for users to update their installations to protect against potential exploitation.

Affected Version(s)

FunnelKit Automations 0 <= 3.8.5.2

References

https://patchstack.com/database/wordpress/plugin/wp-marke...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AndrewN | Patchstack Bug Bounty Program
.