The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress suffers from a missing capability check (CWE-862) in multiple functions. This flaw permits authenticated attackers with Contributor-level privileges or above to update various plugin settings, including templates, designs, and checkout pages. The vulnerability exists in all versions up to 3.4.6. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and resulting in integrity impact but no confidentiality or availability impact.

An attacker with Contributor-level access or higher can modify plugin settings without proper authorization, potentially altering checkout pages, sales funnels, and other configurations. This could lead to unauthorized changes in the e-commerce workflow or user experience, impacting the integrity of the plugin's data and functionality. There is no indication of confidentiality or availability impact, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for unauthorized changes to plugin settings. Avoid granting Contributor or higher privileges to untrusted users to reduce risk.