Skip to content
Threat Feed
Subscribe

Vendor

WPFunnels

1 brief RSS
critical advisory

CVE-2026-14345: Unauthenticated Remote Code Execution in WPFunnels WordPress Plugin

An unauthenticated remote code execution vulnerability (CVE-2026-14345) exists in the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress, affecting versions up to and including 3.12.7, allowing attackers to inject malicious PHP code into a log file via the 'postData' parameter, which is then executed when an administrator views the log.

WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin <= 3.12.7 web-exploit rce wordpress plugin-vulnerability
2t 1c