HomeWordPress vulnerabilitiesWPFunnels
WPFunnels vulnerabilities
WPFunnels has 14 known vulnerabilities in this database. The most recent published record is dated 1 Oct 2026.
- Known vulnerabilities
- 14
- Active installs
- 5,000+
- Latest version
- 3.13.3
- Last updated
- 30 Sep 2026
- Most recent
- 1 Oct 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Broken access control CVE-2026-97269 | Medium 6.5 | Up to 3.13.1 | Fixed in a later version (latest 3.13.3) | 6 d ago |
| Broken access control CVE-2026-84908 | Medium 5.3 | Up to 3.12.13 | Fixed in a later version (latest 3.13.3) | 9 Sep 2026 |
| Broken access control CVE-2026-79632 | Medium 5.3 | Before 3.13.0 | Fixed in 3.13.0 | 4 Sep 2026 |
| Broken access control CVE-2026-79630 | Medium 5.3 | Before 3.13.0 | Fixed in 3.13.0 | 4 Sep 2026 |
| Sensitive data exposure CVE-2026-79631 | Medium 5.3 | Before 3.13.0 | Fixed in 3.13.0 | 4 Sep 2026 |
| Broken access control CVE-2025-15691 | Medium 5.3 | Before 3.13.0 | Fixed in 3.13.0 | 4 Sep 2026 |
| Privilege escalation CVE-2026-15103 | High 8.8 | Up to 3.12.8 | Fixed in a later version (latest 3.13.3) | 16 Jul 2026 |
| File inclusion CVE-2026-13080 | Medium 6.6 | Up to 3.12.7 | Fixed in a later version (latest 3.13.3) | 9 Jul 2026 |
| Remote code execution CVE-2026-14345 | Critical 9.8 | Up to 3.12.7 | Fixed in a later version (latest 3.13.3) | 7 Jul 2026 |
| Cross-site scripting (XSS) CVE-2026-0626 | Medium 6.4 | Up to 3.7.9 | Fixed in a later version (latest 3.13.3) | 4 Apr 2026 |
| Broken access control CVE-2025-12353 | Medium 5.3 | Up to 3.6.2 | Fixed in a later version (latest 3.13.3) | 8 Nov 2025 |
| Remote code execution CVE-2025-12000 | Medium 6.5 | Up to 3.6.2 | Fixed in a later version (latest 3.13.3) | 8 Nov 2025 |
| Cross-site scripting (XSS) CVE-2024-10792 | Medium 6.1 | Up to 3.5.5 | Fixed in a later version (latest 3.13.3) | 21 Nov 2024 |
| Cross-site scripting (XSS) CVE-2023-37977 | High 7.1 | Before 2.7.17 | Fixed in 2.7.17 | 27 Jul 2023 |
Read the published descriptions
- CVE-2026-97269, 1 Oct 2026
- Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions. CVE record
- CVE-2026-84908, 9 Sep 2026
- The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated (wp_ajax_nopriv_) users and the underlying add_offer_product_to_cart() function performing no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout. CVE record
- CVE-2026-79632, 4 Sep 2026
- The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notification recipients and subject from the request, allowing unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject. CVE record
- CVE-2026-79630, 4 Sep 2026
- The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduced price carried through to the total of the order they place. CVE record
- CVE-2026-79631, 4 Sep 2026
- The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled. CVE record
- CVE-2025-15691, 4 Sep 2026
- The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled. This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths. CVE record
- CVE-2026-15103, 16 Jul 2026
- The WPFunnels - Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the `update_settings()` REST callback failing to validate the `group_id` path parameter against an allowlist of permitted option names before passing it directly to `get_option()` and `update_option()`, allowing the built-in `wp_user_roles` option - which satisfies the route's loose `[\w-]+` regex - to be targeted. This makes it possible for authenticated attackers with the `wpf_manage_funnels` capability and above to elevate their privileges to administrator by writing a crafted role definition containing arbitrary capabilities into the `wp_user_roles` option, thereby granting any WordPress role full site administrator access. The `wpf_manage_funnels` capability is typically assigned to the Funnel Manager custom role created by the plugin, meaning this role is the minimum required to exploit the vulnerability. CVE record
- CVE-2026-13080, 9 Jul 2026
- The WPFunnels - Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. CVE record
- CVE-2026-14345, 7 Jul 2026
- The WPFunnels - Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated. CVE record
- CVE-2026-0626, 4 Apr 2026
- The WPFunnels - Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. CVE record
- CVE-2025-12353, 8 Nov 2025
- The WPFunnels - The Easiest Funnel Builder For WordPress And WooCommerce To Collect Leads And Increase Sales plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 3.6.2. This is due to the plugin relying on a user controlled value 'optin_allow_registration' to determine if user registration is allowed, instead of the site-specific setting. This makes it possible for unauthenticated attackers to register new user accounts, even when user registration is disabled. CVE record
- CVE-2025-12000, 8 Nov 2025
- The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). CVE record
- CVE-2024-10792, 21 Nov 2024
- The Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 3.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This was partially patched in 3.5.4 and fully patched in 3.5.5. CVE record
- CVE-2023-37977, 27 Jul 2023
- Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress - WPFunnels plugin <= 2.7.16 versions. CVE record
What to do if you run WPFunnels
If you run WPFunnels, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new WPFunnels vulnerabilities
Free. We email you when a new vulnerability is published for WPFunnels, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.