CVE-2019-25151

The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin on the vulnerable service.

Score

CVSS 3.1 5.4 Medium

Status

Modified - security@wordfence.com

Published

2023-06-07

Last modified

2026-04-08

Weaknesses

CWE-269

Affected products

• Cartflows Funnel Builder Checkout Plugin For Woocommerce (Brainstormforce)
• Cartflows (Cartflows)

References

• https://blog.nintechnet.com/privilege-escalation-vulnerability-fixed-in-wordpress-cartflows-plugin/
• https://wpscan.com/vulnerability/b6725319-909f-4d5c-9b34-8b6ea627b223%5D
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-funnel-builder-by-cartflows-create-high-converting-sales-…
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f0b95670-0767-4325-88d0-4ae6d7302558?source=cve