medium5.3
CVE-2026-79631
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, …
Impact
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
Affected products
| Product | Affected versions |
|---|---|
| WPFunnels WordPress Plugin | before 3.13.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.