Local File Inclusion Vulnerability in WPFunnels Plugin for WooCommerce
CVE-2026-13080

6.6MEDIUM

Key Information:

Vendor

WordPress
Status
WPfunnels – Funnel Builder For WooCommerce With Checkout & One Click Upsell
Vendor
CVE Published:
9 July 2026

What is CVE-2026-13080?

The WPFunnels plugin for WooCommerce suffers from a Local File Inclusion vulnerability which affects all versions up to and including 3.12.7. This vulnerability allows authenticated users with administrator-level permissions to execute arbitrary PHP scripts on the server by leveraging the 'logKey' parameter. Attackers can exploit this flaw to circumvent access controls, extract sensitive information, or execute malicious code embedded in PHP files, posing significant security risks to affected WordPress installations.

Affected Version(s)

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell 0 <= 3.12.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wpfunnels/tags...
https://plugins.trac.wordpress.org/browser/wpfunnels/tags...

CVSS V3.1

Score:
6.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Danh Dao (IAmNewbie)
.