Junglewise Threat Intelligence

CVE-2026-14345: WPFunnels remote code execution via log file inclusion

CVE-2026-14345 · Severity: critical · CVSS 9.8 · Published 2026-07-07

Technologies: WPFunnels. Vendors: WPFunnels.

Executive brief

WPFunnels, a popular WordPress plugin used to create sales funnels for WooCommerce, contains a critical security flaw that allows attackers to execute malicious code on the website's server. By injecting malicious data into the plugin's log files, an attacker can take full control of the site if an administrator later views those logs. This could lead to the theft of customer data, complete site takeover, or the installation of ransomware.

Technical details

The vulnerability is a Remote Code Execution (RCE) flaw stemming from an unsanitized write of attacker-controlled data in the 'postData' parameter into a .log file. The plugin subsequently uses 'include_once' to render this log file within the 'wpfnl_show_log' function, allowing the execution of PHP code embedded in the log. While the final execution requires an administrator to view the logs in the plugin's UI, the initial injection is unauthenticated because the required security nonce is publicly exposed on funnel step pages. The issue is addressed in version 3.12.8.

Affected products

  • getwpfunnels WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell up to, and including, 3.12.7

Timeline

  • 2026-07-07: advisory
  • 2026-07-07: disclosed

References

Related threats