EUVD-2026-42009
GHSA-5fwf-q2jf-gp4v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Injection is unauthenticated (PR:N) but code execution requires the non-default Enable Logs setting (AC:H) and a separate administrator opening the log (UI:R); impact is full RCE (C/I/A:H).
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPFunnels - Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated.
Articles & Coverage 1
AnalysisAI
Remote code execution in the WPFunnels (Funnel Builder for WooCommerce) WordPress plugin versions up to and including 3.12.7 lets attackers write attacker-controlled 'postData' into a PHP-includeable .log file that wpfnl_show_log later renders with include_once, yielding server-side code execution. The initial injection is fully unauthenticated because the nonce guarding the optin endpoint is publicly emitted on every funnel step page, though execution only fires once an administrator opens the poisoned log via the Log Settings View while the 'Enable Logs' toggle is active. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the pre-auth injection combined with a maximal 9.8 CVSS score makes it a high-priority patch for any exposed WooCommerce funnel deployment.
Technical ContextAI
WPFunnels is a WooCommerce sales-funnel/upsell builder for WordPress. The flaw is a log-poisoning-to-LFI chain: unsanitized 'postData' values are written into a .log file (class-wpfnl-settings.php around line 709 and the AJAX handler paths in class-wpfnl-ajax-handler.php), and the wpfnl_show_log routine then passes that same file to PHP include_once, so any PHP embedded in the log body is parsed and executed. Although NVD tags this CWE-434 (Unrestricted Upload of File with Dangerous Type), the mechanism is more precisely PHP code injection via file inclusion (CWE-98/CWE-94 territory): the attacker never uploads a file directly but controls the contents of a file that the application include()s. The reachability hinges on WordPress nonce handling - the optin nonce is leaked in the public funnel-step markup (public/class-wpfnl-public.php line 1185), collapsing what would normally be an authenticated write into an unauthenticated one.
RemediationAI
Vendor-released patch: 3.12.8 - update the WPFunnels plugin to 3.12.8 or later immediately (changeset 3597260 and the 3.12.7→3.12.8 diff at https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpfunnels/tags/3.12.7&new_path=%2Fwpfunnels/tags/3.12.8; advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/5d84d749-0ab5-49dd-8e4f-45681f197742). If you cannot patch right away, the most effective compensating control is to turn OFF the Log Settings 'Enable Logs' toggle, which removes the write sink and the includeable log file entirely - the trade-off is loss of funnel debugging telemetry, which is acceptable for most production sites. As additional hardening, avoid opening the plugin's Log Settings View (the trigger step), delete any existing WPFunnels .log files that may already be poisoned, and place a WAF rule to block requests carrying PHP tags in the 'postData' parameter to the optin AJAX endpoint. Because the guarding nonce is publicly emitted, do not rely on nonce validation as a control.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Share
External POC / Exploit Code
Leaving vuln.today