WPFunnels CVE-2026-79631

Exploitation requires the WPFunnels plugin's logging feature to be enabled - the description explicitly states 'when logging is enabled,' indicating a configurable condition rather than always-on behavior. Whether logging is enabled by default in versions 2.6.0-3.13.0 is not confirmed by available data and represents a key unknown for triage. No authentication, user interaction, or special network positioning is required once logging is active; the log files reside in the standard web-accessible uploads directory. The primary limiting factor is therefore the logging-enabled configuration state: installations with logging disabled generate no exposed log files and are not exploitable.

The CVSS 5.3 Medium vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects unauthenticated, low-complexity network exploitation with partial confidentiality impact. In practice, the C:L rating may understate business risk: log contents can include customer PII that triggers notification obligations under GDPR, CCPA, and similar frameworks. A publicly available PoC raises the likelihood of opportunistic scanning by automated tools. The key limiting factor is that logging must be enabled - if this is a non-default configuration (which the available data does not confirm either way), real-world exposure is narrower than the AC:L vector implies, and the effective attack complexity is closer to AC:H. No EPSS data was provided and no KEV listing exists, so the current exploitation probability is unconfirmed. Sites actively processing funnel orders with logging on represent the highest-risk deployment profile.

An attacker identifies a WordPress site running WPFunnels with logging enabled, constructs the predictable URL path to the plugin's log file within wp-content/uploads/ using known naming conventions for the plugin, and issues a direct unauthenticated HTTP GET request. The server returns the log file containing customer names, email addresses, order items, and opt-in submission data with no authentication challenge. A public PoC facilitates this enumeration step.