CVE-2026-13080

Name of the Vulnerable Software and Affected Versions WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell versions prior to 3.12.8

Description A Local File Inclusion issue exists where authenticated attackers with administrator-level access and above can include and execute arbitrary .php files on the server. This is achieved via the logKey parameter, allowing the execution of any PHP code contained within those files. This flaw can be leveraged to bypass access controls, obtain sensitive data, or achieve remote code execution if .php files can be uploaded to the server.

Recommendations Update the plugin to version 3.12.8 or later.