WPFunnels vulnerabilities

The WPFunnels plugin in versions up to and including 3.13.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.

The WPFunnels plugin versions 3.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

The WPFunnels plugin for WordPress up to version 3.12.7 is vulnerable to Remote Code Execution via the 'postData' parameter. An unauthenticated attacker can write malicious data into a .log file, which is later included via include_once, allowing code execution on the server. Exploitation requires logging to be enabled and an administrator to view the polluted log file.

The WPFunnels plugin for WordPress up to version 3.13.3 contains a stored XSS (Cross-site Scripting) vulnerability due to improper neutralization of input during web page generation.

Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels up to version 3.13.1 allows an attacker to access resources without authorization.

The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.12.13. The plugin registers the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated users (wp_ajax_nopriv_) and the underlying add_offer_product_to_cart() function performs no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.

The WPFunnels WordPress plugin before version 3.13.0 does not perform any authorization or nonce check in one of its opt-in submission handlers, and takes notification recipients and subject from the request. This allows unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.

The WPFunnels WordPress plugin before version 3.13.0 does not restrict access to log files it writes to a predictable location under the public uploads directory. This allows unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.

The WPFunnels WordPress plugin before version 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for. This allows unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place.

The WPFunnels plugin versions up to 3.12.13 contain an unauthenticated broken access control vulnerability. This allows unauthorized access to protected features.

The WPFunnels plugin for WordPress up to version 3.12.8 is vulnerable to privilege escalation via arbitrary option update. Lack of validation of the `group_id` parameter in the REST API allows attackers with `wpf_manage_funnels` capability to modify the `wp_user_roles` option, enabling them to assign themselves the administrator role.

The WPFunnels plugin for WordPress is vulnerable to Local File Inclusion (LFI) in all versions up to and including 3.12.7 via the 'logKey' parameter. Authenticated attackers with administrator-level access can include and execute arbitrary .php files on the server.

Stored Cross-Site Scripting (XSS) vulnerability in WordPress WPFunnels plugin up to version 3.7.9. Through the 'wpf_optin_form' shortcode and 'button_icon' parameter, attackers with contributor-level access or higher can inject arbitrary scripts that execute when a page is visited.

The WPFunnels – The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled.

The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers with Administrator-level access and above to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).