5.3
Medium
CVE-2026-79631 The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable…
Description
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WPFunnels 2.6 | 2.6.0 → < 3.13.0 | 3.13.0 |
Other CVEs of WPFunnels
The 4 CVEs of WPFunnels →
CVE-2026-79630
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump…
5.3
Medium
CVE-2026-79632
The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in…
5.3
Medium
CVE-2025-15691
The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before…
5.3
Medium