Executive brief
WPFunnels is a WordPress plugin that manages sales funnels and customer forms for WooCommerce stores. When logging is enabled (an optional feature), the plugin writes customer data—including order details and form submissions with names, emails, and phone numbers—to predictable log files in a publicly accessible directory. An attacker can download these files without any authentication, exposing sensitive customer information indefinitely.
Technical details
This vulnerability is an information disclosure issue (CWE-200) caused by inadequate access controls on log files. The WPFunnels plugin writes daily log files to a predictable location under /wp-content/uploads/wpfunnels/wpfunnels-logs/ (or /wp-content/uploads/wpfunnels-logs/ in versions before 3.0.0) with filenames following a fixed pattern: wpfunnels-event-log-YYYY-MM-DD.log. The files contain order details, opt-in form submissions with PII, and are not protected by access controls (the .htaccess file added from version 3.12.8 is ignored by nginx servers). An unauthenticated attacker can craft a simple HTTP request to retrieve any log file, and since logs are never rotated, historical data remains accessible. The vulnerability affects WPFunnels before version 3.13.0, requires only that logging be enabled (disabled by default but often left on for debugging), and requires no user interaction or authentication. The fix is available in version 3.13.0.
Affected products
- WPFunnels WPFunnels before 3.13.0
Timeline
- 2026-09-02: disclosed
- 2026-09-04: patched: Fix released in version 3.13.0