Description

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T07:17:09.923Z",
  "pubdate": "2026-09-04T07:17:09.923Z",
  "executiveSummary": "The WPFunnels WordPress plugin, in versions prior to 3.13.0, contains an information disclosure vulnerability resulting from improper access control configuration regarding sensitive log files.\nThe vulnerability type is categorized as Improper Access Control, which facilitates the unauthorized retrieval of sensitive data stored within the public uploads directory.\nThe scope of impact includes the exposure of customer order details and opt-in form submissions, which represents a significant risk to PII (Personally Identifiable Information) confidentiality and potential regulatory non-compliance.\nAttackers can exploit this flaw without authentication, as the log files are written to predictable locations accessible via standard HTTP requests.\nThe requirement for exploitation is minimal, necessitating only knowledge of the log file location and that the logging feature is enabled within the plugin settings.\nThis vulnerability allows remote, unauthenticated actors to harvest sensitive transactional data, potentially leading to identity theft or further targeted exploitation of the organization's customer base.",
  "technicalDetails": "The root cause of the vulnerability lies in the storage of application-generated log files within the public-facing 'uploads' directory of the WordPress installation without enforcing adequate server-side access controls.\nThe plugin mechanism for logging transactional data and opt-in information fails to implement directory protection, such as .htaccess restrictions, or serve these files through a PHP-based controller that validates user session permissions.\nBecause the log files are generated with predictable naming conventions and placed in a standard, publicly accessible path, any unauthenticated remote actor can perform direct object reference requests to these resources.\nThe attack flow follows a straightforward pattern: First, the attacker identifies that the target is running an affected version of WPFunnels (prior to 3.13.0). Second, the attacker probes for the existence of log files within the public uploads directory structure.\nUpon successful identification, the attacker issues standard GET requests to the identified URI. Because the web server is configured to serve static files from the uploads directory and no security layer prevents access, the server returns the contents of the log file, which may contain plaintext sensitive information.\nThe vulnerability affects all versions of the WPFunnels plugin released before 3.13.0, specifically impacting any site where the 'logging' feature has been toggled to an active state.\nThere are no authentication or authorization requirements for an attacker; the vulnerability is exposed to the public internet by design of the directory structure and the absence of file-level permissions.\nThe post-exploitation impact includes the systematic extraction of customer order histories, contact information, and opt-in submission data, creating a severe data breach scenario that violates data privacy principles and industry standards."
}