WPFunnels Plugin CVE-2026-13080

Exploitation requires an active WordPress session with administrator-level privileges (or higher) on a site running WPFunnels 3.12.7 or earlier. Beyond authentication, the attacker must be able to place a PHP file at a known or guessable server-side path - achievable via WordPress's built-in media uploader (if PHP uploads are not blocked by file-type restrictions), the theme/plugin file editor, FTP/SFTP access, or a separate vulnerability. Without a controllable PHP file on the server, the attacker is constrained to reading existing PHP files, limiting impact to information disclosure rather than full RCE. Sites where the WPFunnels plugin is not installed or activated, where administrator role assignment is tightly controlled, or where server-side PHP file upload is blocked at the web server or PHP configuration level are not exploitable under this CVE.

The CVSS 3.1 score of 6.6 with vector AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H accurately captures the constrained but severe nature of this flaw. The requirement for PR:H (WordPress administrator) and AC:H (secondary condition: a controllable PHP file on the server) substantially narrows the exploitable attack surface compared to a typical unauthenticated RCE. No EPSS score was provided in the available data, and the vulnerability is not listed in CISA's KEV catalog, indicating no confirmed active exploitation at time of analysis. No public proof-of-concept code has been identified. Real-world risk is most elevated in scenarios where admin credentials are weakly protected (e.g., shared hosting, reused passwords), where PHP file upload is permitted to admins, or where this flaw is chained after a separate authentication bypass or privilege escalation. For environments with tightly controlled admin access and PHP upload restrictions, actual exploitation risk is low despite the severe CVSS impact metrics. This is a patch-on-next-cycle vulnerability, not an emergency.

An attacker who has acquired WordPress administrator credentials through phishing or credential stuffing uploads a PHP web shell to the server via the WordPress media uploader or theme/plugin editor. The attacker then sends an authenticated POST request to the vulnerable WPFunnels settings endpoint, supplying the server path to the uploaded shell in the logKey parameter, causing the plugin to include and execute the file. This yields arbitrary server-side code execution under the web server process identity, enabling lateral movement, data exfiltration, or persistence beyond the WordPress application layer.