WordPress Plugin Vulnerabilities

WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files

Description

The plugin does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.

Proof of Concept

Affects Plugins

Plugin icon
wpfunnels
Fixed in 3.13.0

References

CVE
CVE-2026-79631

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Abdullah Kareem
Submitter
Abdullah Kareem
Submitter website
https://cyberkareem.com
Verified
Yes
WPVDB ID
70d377d4-87d1-4f74-984d-f93eb5beaa2f

Timeline

Publicly Published
2026-09-02 (about 2 days ago)
Added
2026-09-02 (about 1 day ago)
Last Updated
2026-09-02 (about 1 day ago)

Other

Published
Title
Published
2024-02-26
Title
WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit <= 1.0.9 - Unauthenticated Sensitive Information Exposure
Published
2026-06-15
Title
Cherry Framework <= 3.1.4 - Unauthenticated Backup Download
Published
2022-03-09
Title
Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure
Published
2026-06-30
Title
Ninja Forms < 3.14.2 - Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
Published
2025-10-10
Title
Trinity Audio < 5.22.0 - Unauthenticated Information Exposure