FunnelKit Automations WordPress plugin: Cross-site request forgery

Summary

The FunnelKit Automations WordPress plugin (wp-marketing-automations) up to and including version 3.8.5.2 contains a Cross-Site Request Forgery (CSRF) flaw. An attacker can trick a logged-in WordPress user, typically an administrator or shop manager, into visiting a malicious page that performs unintended actions on the site. The CNA rates the CVSS score 8.8, but Patchstack classifies the practical impact as low and unlikely to be exploited.

Affected

• FunnelKit Automations (wp-marketing-automations) WordPress plugin, versions up to and including 3.8.5.2
• CVE record range: from n/a through 3.8.5.2

Fixed in

• Version 3.8.6 or later (according to Patchstack)

Workaround

• No vendor workaround known.
• Until patched, log out of the WordPress admin when not in use, avoid browsing other sites in the same session, and restrict admin access where practical.

Exploitation

• No known exploitation in the wild.
• CISA SSVC in the CVE record: exploitation none, automatable no.
• Not listed in CISA KEV. No public proof of concept found.

Our recommendation

• Update FunnelKit Automations to version 3.8.6 or later on all WordPress sites and verify the installed version.
• Review administrator and shop manager accounts for unused or over-privileged users.
• Restrict admin access and avoid browsing other websites while logged in to the WordPress admin.
• Check the wordpress.org changelog or ask FunnelKit to confirm the security fix, as no vendor advisory was found.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE CVE-2026-111841 app.opencve.io
• VulDB CVE-2026-111841 vuldb.com
• OffSeq Radar CVE-2026-111841 radar.offseq.com
• WordPress.org plugin page wordpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:34.