CVE-2026-13080: WPFunnels Local File Inclusion Vulnerability (Admin-Level RCE Risk)

Technical summary

The vulnerability is a Local File Inclusion flaw (CWE-98) in the WPFunnels plugin's handling of the 'logKey' parameter. The plugin fails to properly validate or sanitize this parameter before using it in file inclusion operations, allowing an authenticated administrator to specify an arbitrary path to a .php file on the filesystem. When the parameter is processed, the included file's PHP code executes within the WordPress application context, granting the attacker the privileges of the web server process. The CVSS 3.1 score of 6.6 (MEDIUM) reflects the requirement for high-privilege authentication, offset by the potential for complete confidentiality, integrity, and availability impact.

Business impact

For WooCommerce merchants using WPFunnels, this vulnerability poses a risk primarily from insider threats or compromised administrator accounts. A malicious or compromised admin could execute arbitrary code to steal customer payment data, modify transaction records, inject malware into the storefront, or establish persistent access. The impact extends beyond the plugin to the entire WordPress installation and potentially the underlying server. Organizations with strict access controls and regular admin account audits face lower risk; those with shared or overprivileged administrator accounts face higher risk.

Affected systems

All versions of the WPFunnels – Funnel Builder for WooCommerce plugin up to and including version 3.12.7 are affected. The plugin is widely distributed through the WordPress plugin repository and is typically installed on WooCommerce stores. Any WordPress installation running this plugin version is potentially vulnerable if an administrator-level user is compromised or acts maliciously. Sites using newer versions (if available) or that have removed the plugin are not affected.

Exploitability

Exploitation requires valid WordPress administrator credentials, which significantly limits attack surface compared to unauthenticated vulnerabilities. However, admin credentials are high-value targets for threat actors. The attack does not require user interaction. If an attacker already controls an admin account—through credential compromise, insider access, or supply chain attack—they can immediately exploit the LFI to execute arbitrary code. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Immediately update the WPFunnels plugin to a patched version released after 3.12.7. Verify the plugin's release notes or vendor advisory for confirmation of the fix. As an interim measure, restrict WordPress administrator role assignments to trusted personnel only, implement IP whitelisting on wp-admin access, enforce strong password policies, and enable multi-factor authentication (MFA) for all administrator accounts. Monitor admin login activity and file inclusion patterns in web server logs.

Patch guidance

Check the WPFunnels plugin repository or the vendor's website for updates released after version 3.12.7. Apply the latest stable version through the WordPress admin dashboard (Plugins > Updates). Before deploying to production, test the update in a staging environment to ensure compatibility with your WooCommerce configuration, active themes, and other plugins. Document the update timestamp and confirm functionality of critical sales funnels and checkout flows post-patch.

Detection guidance

Monitor web server and PHP error logs for file inclusion attempts targeting PHP files outside the expected plugin directory structure, particularly those referencing logKey parameter values with path traversal sequences (../, .., etc.). Review WordPress admin access logs for unusual activity from privileged accounts, especially during non-business hours. Use WordPress security plugins (e.g., Wordfence, Sucuri) configured to alert on file inclusion patterns and suspicious parameter values. Check for unexpected PHP files in upload directories or suspicious modifications to plugin files.

Why prioritize this

While the CVSS score is MEDIUM (6.6), this vulnerability merits prompt attention because: (1) WooCommerce stores handle sensitive payment and customer data; (2) successful exploitation leads to complete code execution; (3) admin account compromise is a realistic attack vector through phishing, credential leaks, or malware; (4) the plugin may be installed on hundreds of thousands of sites. Organizations should prioritize patching alongside broader hardening of administrator access controls.

Risk score, explained

The CVSS 3.1 score of 6.6 reflects a high-impact vulnerability (complete confidentiality, integrity, and availability compromise) that requires two significant conditions: network access and high-privilege authentication. The Attack Complexity is High, accounting for the need to obtain or exploit admin credentials. While this places it in the MEDIUM severity band, the practical risk to your organization depends heavily on admin account hygiene and monitoring. A tight circle of trusted admins with MFA significantly reduces risk; shared accounts or overprivileged roles increase it.

Frequently asked questions