WPFunnels Unauthenticated Remote Code Execution via Log File Poisoning

Technical Analysis

CVE-2026-14345 arises from WPFunnels writing attacker-controlled 'postData' values into a .log file without sanitization, which is subsequently rendered using PHP's include_once function in the wpfnl_show_log routine—a classic log poisoning to RCE chain. Exploitation requires the 'Enable Logs' setting to be active and an administrator to view the log via the plugin's UI, but the nonce needed to reach the injection endpoint is publicly exposed on every funnel step page, making the payload injection step fully unauthenticated and low-effort for attackers. Successful exploitation grants arbitrary PHP code execution in the context of the web server, enabling full site takeover, backdoor installation, and lateral movement within hosting environments. Organizations running AI agents, RAG pipelines, or LLM-powered automation on WordPress-adjacent infrastructure (e.g., shared hosting, CMS-driven content ingestion for RAG, or agent-triggered WooCommerce workflows) face risk if compromised hosts store API keys, database credentials, or agent orchestration secrets accessible from the web root, warranting the 'agent-relevant' classification.

Affected Systems

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin, all versions up to and including 3.12.7, on WordPress installations with WooCommerce; exploitability requires 'Enable Logs' toggle active in Log Settings

Indicators of Compromise

• Suspicious entries in WPFunnels log files containing PHP code fragments (e.g., <?php tags) within 'postData' fields
• Unexpected admin access to Log Settings > View Log shortly before unauthorized file modifications
• Unknown PHP files or webshells created in wp-content/uploads or plugin log directories
• Anomalous outbound connections from WordPress hosting environment post log-view event

Remediation Steps

1. 1

   Update WPFunnels Plugin

   Upgrade to the patched version of WPFunnels beyond 3.12.7 as soon as it is released by the vendor; monitor the plugin changelog and WordPress.org plugin repository for the fix.

2. 2

   Disable Logging Temporarily

   Turn off the 'Enable Logs' toggle in WPFunnels Log Settings until a patch is applied to eliminate the log-poisoning attack surface.

3. 3

   Restrict Admin Access to Log Viewer

   Limit access to the plugin's Log Settings View UI to trusted administrators only, and audit recent log file access and content for injected PHP payloads.

4. 4

   Web Application Firewall Rules

   Deploy WAF rules to detect and block PHP code injection patterns in the 'postData' parameter and funnel step requests.

5. 5

   Credential Rotation

   If compromise is suspected, rotate all WordPress admin, database, and API credentials, including any keys used by connected automation or AI agent integrations.

6. 6

   File Integrity Monitoring

   Implement monitoring for unauthorized changes to plugin log files and unexpected PHP file creation within the WordPress directory structure.