Is CVE-2026-79631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79631 being exploited in the wild.

How severe is CVE-2026-79631?

Medium severity, with a CVSS score of 5.3, published 4 September 2026.

Is there a fix for CVE-2026-79631?

A patch was published on 2026-09-04: Fix released in version 3.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79631 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-79631?

Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79631: WPFunnels WordPress plugin information disclosure via web-accessible logs

CVE-2026-79631 · Severity: medium · CVSS 5.3 · Published 2026-09-04

WPFunnels is a WordPress plugin that manages sales funnels and customer forms for WooCommerce stores. When logging is enabled (an optional feature), the plugin writes customer data—including order details and form submissions with names, emails, and phone numbers—to predictable log files in a publicly accessible directory. An attacker can download these files without any authentication, exposing sensitive customer information indefinitely.

Technologies: WPFunnels. Vendors: WPFunnels.

Quick answers

Is CVE-2026-79631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79631 being exploited in the wild.
How severe is CVE-2026-79631?: Medium severity, with a CVSS score of 5.3, published 4 September 2026.
Which products and versions are affected?: WPFunnels before 3.13.0.
Is there a fix for CVE-2026-79631?: A patch was published on 2026-09-04: Fix released in version 3.13.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79631 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-79631?: Check whether you run WPFunnels at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an information disclosure issue (CWE-200) caused by inadequate access controls on log files. The WPFunnels plugin writes daily log files to a predictable location under /wp-content/uploads/wpfunnels/wpfunnels-logs/ (or /wp-content/uploads/wpfunnels-logs/ in versions before 3.0.0) with filenames following a fixed pattern: wpfunnels-event-log-YYYY-MM-DD.log. The files contain order details, opt-in form submissions with PII, and are not protected by access controls (the .htaccess file added from version 3.12.8 is ignored by nginx servers). An unauthenticated attacker can craft a simple HTTP request to retrieve any log file, and since logs are never rotated, historical data remains accessible. The vulnerability affects WPFunnels before version 3.13.0, requires only that logging be enabled (disabled by default but often left on for debugging), and requires no user interaction or authentication. The fix is available in version 3.13.0.

Affected products

WPFunnels WPFunnels before 3.13.0

Timeline

2026-09-02: disclosed
2026-09-04: patched: Fix released in version 3.13.0

References

https://wpscan.com/vulnerability/70d377d4-87d1-4f74-984d-f93eb5beaa2f/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.