CVE-2026-13080
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
The WPFunnels plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.12.7 via the 'logKey' parameter. Authenticated attackers with administrator-level access can include and execute arbitrary .php files on the server.
Risk Assessment
An attacker with admin privileges can bypass access controls, obtain sensitive data, or achieve code execution if .php files can be uploaded. This could lead to full compromise of the WordPress server.
Recommendation
Immediately update the WPFunnels plugin to the latest available version. Restrict administrative access to trusted users only and consider deploying a Web Application Firewall (WAF) to block 'logKey' parameter exploitation.
Other vulnerabilities in WPFunnels
See all- CVE-2026-14345Critical
The WPFunnels plugin for WordPress up to version 3.12.7 is vulnerable to Remote Code Execution via the 'postData' parameter. An unauthenticated attacker can write malicious data into a .log file, which is later included via include_once, allowing code execution on the server. Exploitation requires logging to be enabled and an administrator to view the polluted log file.
- CVE-2026-15103High
The WPFunnels plugin for WordPress up to version 3.12.8 is vulnerable to privilege escalation via arbitrary option update. Lack of validation of the `group_id` parameter in the REST API allows attackers with `wpf_manage_funnels` capability to modify the `wp_user_roles` option, enabling them to assign themselves the administrator role.
- CVE-2026-0626Medium
Stored Cross-Site Scripting (XSS) vulnerability in WordPress WPFunnels plugin up to version 3.7.9. Through the 'wpf_optin_form' shortcode and 'button_icon' parameter, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.
Original NVD description (English source)
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.