Login Request a demo
Medium severity · published Jul 9, 2026
CVE-2026-13080
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
6.6
CVSS
1.2%
EPSS
No
On KEV
Description
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WF
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell · getwpfunnels
through 3.12.7 · source: vendor
Affected product
WF
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
getwpfunnels
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13080
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13080
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.11.0/admin/modules/settings/class-wpfnl-settings.php#L181
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.11.0/admin/modules/settings/class-wpfnl-settings.php#L703
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.11.0/admin/modules/settings/class-wpfnl-settings.php#L709
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.11.0/vendor/philipnewcomer/wp-ajax-helper/src/components/Utility.php#L26
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.6/admin/modules/settings/class-wpfnl-settings.php#L181
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.12.6/admin/modules/settings/class-wpfnl-settings.php#L703
More from WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
9.8
CVE-2026-14345
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
8.8
CVE-2026-15103
WPFunnels <= 3.12.8 - Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter
6.5
CVE-2025-12000
WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
6.4
CVE-2026-0626
WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode
6.1
CVE-2024-10792
Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels <= 3.5.5 - Reflected Cross-Site Scripting