CVE-2026-79631: WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPFunnels WordPress pluginto a version that resolves this vulnerability.Fixed in 3.13.0
Event History
Frequently Asked Questions
Who can access the exposed information?
Any unauthenticated user who can reach the WordPress site's public uploads directory can download the affected log files when logging is enabled. No WordPress account or other authentication is required.
What information may be present in the accessible logs?
The logs may contain customer order details and opt-in form submissions, which can include personally identifiable information.
When is a site affected?
Exposure requires a WPFunnels version earlier than 3.13.0 and enabled logging. The issue exists because logs are written to a predictable location beneath the publicly accessible uploads directory without access restrictions.