CVE-2026-79631
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WPFunnels WordPress plugin before version 3.13.0 does not restrict access to log files it writes to a predictable location under the public uploads directory. This allows unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
Risk Assessment
Sensitive customer data such as order details and personal information may be publicly exposed, violating data protection regulations and potentially leading to identity theft.
Recommendation
Update the WPFunnels plugin to version 3.13.0 or later, and consider disabling logging or securing the log directory.
Other vulnerabilities in WPFunnels
See all- CVE-2026-14345Critical
The WPFunnels plugin for WordPress up to version 3.12.7 is vulnerable to Remote Code Execution via the 'postData' parameter. An unauthenticated attacker can write malicious data into a .log file, which is later included via include_once, allowing code execution on the server. Exploitation requires logging to be enabled and an administrator to view the polluted log file.
- CVE-2026-79632Medium
The WPFunnels WordPress plugin before version 3.13.0 does not perform any authorization or nonce check in one of its opt-in submission handlers, and takes notification recipients and subject from the request. This allows unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
- CVE-2026-79630Medium
The WPFunnels WordPress plugin before version 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for. This allows unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.
- CVE-2026-84754Medium
The WPFunnels plugin versions up to 3.12.13 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.
- CVE-2026-15103High
The WPFunnels plugin for WordPress up to version 3.12.8 is vulnerable to privilege escalation via arbitrary option update. Lack of validation of the `group_id` parameter in the REST API allows attackers with `wpf_manage_funnels` capability to modify the `wp_user_roles` option, enabling them to assign themselves the administrator role.
- CVE-2026-13080Medium
The WPFunnels plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.12.7 via the 'logKey' parameter. Authenticated attackers with administrator-level access can include and execute arbitrary .php files on the server.
- CVE-2026-0626Medium
Stored Cross-Site Scripting (XSS) vulnerability in WordPress WPFunnels plugin up to version 3.7.9. Through the 'wpf_optin_form' shortcode and 'button_icon' parameter, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.
Original NVD description (English source)
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.