What is the CVSS score of CVE-2026-13080?

CVE-2026-13080 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

WPFunnels Plugin CVE-2026-13080

EUVD-2026-42525 MEDIUM

PHP Remote File Inclusion (CWE-98)

2026-07-09 Wordfence

GHSA-xjfr-2v67-fwc9

PHP WordPress RCE Information Disclosure LFI Wpfunnels Funnel Builder For Woocommerce With Checkout One Click Upsell Wordpress Plugin Getwpfunnels

6.6

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.6 MEDIUM

Administrator credentials required (PR:H) and attacker must control a server-side PHP file (AC:H); no scope change; full C/I/A impact on successful exploitation via arbitrary code execution.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 08:47 vuln.today

CVE Published

Jul 09, 2026 - 06:52 nvd

MEDIUM 6.6

DescriptionCVE.org

The WPFunnels - Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

AnalysisAI

Local File Inclusion in the WPFunnels WordPress plugin (all versions through 3.12.7) allows authenticated administrators to include and execute arbitrary PHP files on the server via the unsanitized logKey parameter, yielding full remote code execution when combined with file upload capability. The attack requires administrator-level WordPress credentials and high complexity - specifically the ability to place a PHP file on the server - materially limiting the exploitable population. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a routine-patching priority tier despite its severe potential impact.

Technical ContextAI

CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) describes the root cause: user-supplied input is passed to a PHP file-inclusion directive without adequate path validation or allowlist enforcement. The vulnerable code is confirmed in the WordPress plugin SVN repository at admin/modules/settings/class-wpfnl-settings.php (lines 181, 703, 709) and vendor/philipnewcomer/wp-ajax-helper/src/components/Utility.php (line 26) across at least tags 3.11.0 and 3.12.6, per direct source references. The affected CPE is cpe:2.3:a:getwpfunnels:wpfunnels_-_funnel_builder_for_woocommerce_with_checkout_&_one_click_upsell. Because PHP's include/require can resolve server-local paths controlled by the logKey parameter, an attacker who can stage a PHP file anywhere on the filesystem can pivot from LFI to full RCE - a well-understood and reliable escalation pattern in PHP-based CMS environments.

RemediationAI

Administrators should update the WPFunnels plugin to a version beyond 3.12.7 immediately upon a confirmed patched release becoming available; a fix commit is referenced in the WordPress plugin changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3597260%40wpfunnels&new=3597260%40wpfunnels, but the exact patched version number is not independently confirmed from available data - monitor the Wordfence advisory and the WordPress.org plugin page for the confirmed release. As an interim compensating control, disabling PHP file upload capability for all WordPress users eliminates the secondary prerequisite needed to convert LFI into RCE; note this may affect legitimate media and theme workflows. Enforcing the principle of least privilege by auditing and minimizing administrator role assignments reduces the pool of potential abusers. Deploying a web application firewall rule to detect and block path traversal patterns (e.g., ../, absolute paths) in the logKey parameter provides an additional defensive layer, though WAF bypass is possible with obfuscated payloads. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e48ce7d2-0c57-499a-81b6-2d9488de704c for updated patch status.