CVE-2026-79631 — WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files

CVE-2026-79631

WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files PUBLISHED

Description (CNA)

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.

Affected (CNA)

Vendor / product	Versions
Unknown / WPFunnels	affected 2.6.0 before 3.13.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/70d377d4-87d1-4f74-984d-f93eb5beaa2f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.