CVE-2026-79631 — WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthen…
Published: 2026-09-04 · CVSS: 5.3 · CVSS 3.1
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7