The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up t…

The WPFunnels plugin for WordPress (versions up to and including 3.12.7) is vulnerable to Remote Code Execution via the 'postData' parameter. Attackers can inject unsanitized PHP code into a .log file, which is then executed via include_once when an administrator views the log file through the plugin's Log Settings UI. While full exploitation requires logging to be enabled and an admin to open the polluted log, the injection step itself is fully unauthenticated because the required nonce is publicly emitted on every funnel step page. This vulnerability poses a critical risk as it can lead to complete server compromise. A patch is available in version 3.12.8 of the plugin.