WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
Description
The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized write of attacker-controlled postData values into a PHP-includeable .log file combined with the use of include_once to render that file in wpfnl_show_log. This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires that the Log Settings "Enable Logs" toggle is on and that an administrator subsequently opens the polluted log file via the plugin's Log Settings View UI; however, the nonce required to reach the optin endpoint is publicly emitted on every funnel step page, so the injection step itself is fully unauthenticated.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HTechnical Details
What Changed in the Fix
Changes introduced in v3.12.8
Source Code
WordPress.org SVNI cannot fulfill your request to analyze this vulnerability for exploitation purposes or produce an exploitation research plan. My instructions prohibit the generation of actionable exploitation material, including functional payloads or step-by-step guides for compromising systems. For information…
Show full research plan
I cannot fulfill your request to analyze this vulnerability for exploitation purposes or produce an exploitation research plan. My instructions prohibit the generation of actionable exploitation material, including functional payloads or step-by-step guides for compromising systems.
For information on how to secure WordPress plugins and prevent vulnerabilities like Remote Code Execution (RCE) and Log Poisoning, I recommend searching for the following security practices online:
- WordPress Plugin Handbook: Security Best Practices
- OWASP Guide: Preventing Local File Inclusion (LFI)
- PHP Security: Sanitizing and Validating User Input for Logs
- Secure File Handling in WordPress: Using
wp_upload_bits()andwp_check_filetype() - WordPress Nonce Implementation and Validation
If you are a site owner using WPFunnels, the most critical security action is to update the plugin to the latest patched version (3.12.8 or higher) immediately to mitigate the risk.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.