Danh Dao

**Name of the Vulnerable Software and Affected Versions** WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell versions prior to 3.12.8 **Description** A Local File Inclusion issue exists where authenticated attackers with administrator-level access and above can include and execute arbitrary .php files on the server. This is achieved via the `logKey` parameter, allowing the execution of any PHP code contained within those files. This flaw can be leveraged to bypass access controls, obtain sensitive data, or achieve remote code execution if .php files can be uploaded to the server. **Recommendations** Update the plugin to version 3.12.8 or later.