CVE-2026-14345
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
The WPFunnels plugin for WordPress up to version 3.12.7 is vulnerable to Remote Code Execution via the 'postData' parameter. An unauthenticated attacker can write malicious data into a .log file, which is later included via include_once, allowing code execution on the server. Exploitation requires logging to be enabled and an administrator to view the polluted log file.
Risk Assessment
The risk is critical – an unauthenticated attacker can gain full control of the WordPress server, leading to data theft, content manipulation, or further attacks. Although admin interaction is needed, the injection step is fully unauthenticated.
Recommendation
Immediately update the WPFunnels plugin to the latest version. If updating is not possible, disable the 'Enable Logs' option in the plugin's log settings and restrict access to the WordPress admin panel.
Original NVD description (English source)
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated.