CVE-2024-6836
📋 TL;DR
This vulnerability allows authenticated WordPress users with Contributor-level access or higher to modify plugin settings without proper authorization. Attackers can update templates, designs, checkouts, and other critical plugin configurations. All WordPress sites using the vulnerable Funnel Builder plugin are affected.
💻 Affected Systems
- Funnel Builder for WordPress by FunnelKit
📦 What is this software?
Funnel Builder by Funnelkit
⚠️ Risk & Real-World Impact
Worst Case
An attacker could modify checkout pages to steal payment information, redirect users to malicious sites, or disrupt e-commerce functionality entirely.
Likely Case
Attackers with legitimate contributor accounts could deface checkout pages, modify pricing, or disrupt sales funnel operations.
If Mitigated
With proper user access controls and monitoring, impact is limited to unauthorized configuration changes that can be detected and reverted.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once an attacker has contributor-level credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.7
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3123202/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find 'Funnel Builder for WordPress by FunnelKit'. 4. Click 'Update Now' or manually update to version 3.4.7 or later.
🔧 Temporary Workarounds
Temporarily disable plugin
allDisable the vulnerable plugin until patching is possible
wp plugin deactivate funnel-builder
Restrict user roles
allTemporarily remove Contributor and higher roles from untrusted users
wp user remove-role <username> contributor
wp user remove-role <username> author
wp user remove-role <username> editor
🧯 If You Can't Patch
- Implement strict user access controls and review all users with Contributor or higher roles
- Enable detailed logging of plugin configuration changes and monitor for unauthorized modifications
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Funnel Builder for WordPress by FunnelKit. If version is 3.4.6 or lower, you are vulnerable.Check Version:
wp plugin get funnel-builder --field=versionVerify Fix Applied:
After updating, verify plugin version shows 3.4.7 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual plugin configuration changes from contributor-level users
- Multiple settings updates in short timeframes
- Changes to checkout or funnel templates
Network Indicators:
- Unusual AJAX requests to /wp-admin/admin-ajax.php with funnel-builder actions
SIEM Query:
source="wordpress.log" AND (plugin="funnel-builder" OR action="wfacp_*") AND user_role="contributor"🔗 References
- https://plugins.trac.wordpress.org/browser/funnel-builder/trunk/modules/checkouts/includes/class-wfacp-ajax-controller.php
- https://plugins.trac.wordpress.org/changeset/3123202/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d9022afe-0c79-413b-ac0a-a1d32ec09619?source=cve
- https://plugins.trac.wordpress.org/browser/funnel-builder/trunk/modules/checkouts/includes/class-wfacp-ajax-controller.php
- https://plugins.trac.wordpress.org/changeset/3123202/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d9022afe-0c79-413b-ac0a-a1d32ec09619?source=cve
