Access Control Vulnerability in WPFunnels WordPress Plugin
CVE-2026-79631
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-79631?
The WPFunnels plugin for WordPress prior to version 3.13.0 features an access control oversight, permitting unauthenticated users to download sensitive log files stored in a predictable location within the public uploads directory. This issue arises when logging is enabled, potentially exposing customer order details and opt-in form submissions to unauthorized access. Users of WPFunnels should update to version 3.13.0 or later to mitigate this risk.
Affected Version(s)
WPFunnels 2.6.0 < 3.13.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.