Is CVE-2026-79631 being exploited?

No public exploit is currently tracked.

Back

CVE-2026-79631

Description

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.