Attack Chain

1. An unauthenticated attacker identifies a WordPress site utilizing a vulnerable version (<= 3.12.7) of the WPFunnels plugin, where the "Enable Logs" setting is active.
2. The attacker accesses any publicly available funnel step page on the target WordPress site to harvest the nonce, which is publicly emitted and required for the next step.
3. The attacker crafts a malicious HTTP POST request targeting the plugin's "optin endpoint," embedding PHP code within the 'postData' parameter, along with the previously retrieved nonce.
4. Due to improper input sanitization, the vulnerable WPFunnels plugin writes the attacker-controlled 'postData', including the malicious PHP code, directly into a PHP-includeable .log file on the web server's filesystem.
5. An administrator of the WordPress site later navigates to the WPFunnels plugin's Log Settings View UI within the WordPress administrative dashboard, potentially for routine monitoring or troubleshooting.
6. Upon viewing the logs, the plugin's wpfnl_show_log function uses include_once to render the content of the polluted .log file.
7. The include_once call executes the malicious PHP code previously injected by the attacker, leading to unauthenticated Remote Code Execution on the underlying web server.

Impact

Successful exploitation of CVE-2026-14345 results in unauthenticated Remote Code Execution (RCE) on the vulnerable WordPress web server. This provides attackers with full control over the compromised server, enabling them to deface the website, inject malware, exfiltrate sensitive data, establish persistence, or use the server as a pivot point for further attacks on the internal network. The CVSS v3.1 base score of 9.8 indicates a critical severity, highlighting the ease of exploitation and significant potential for damage, impacting any organization running the affected plugin versions.

Recommendation

• Patch CVE-2026-14345 immediately by updating the "WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin" to a version greater than 3.12.7.
• Review WordPress webserver access logs for unusual POST requests targeting plugin-related "optin endpoints" that might contain suspicious data in the request body, indicating exploitation attempts for CVE-2026-14345.
• Monitor file integrity and changes within the wp-content/plugins/wpfunnels/ directory, specifically looking for unexpected modifications or creations of .log or .php files.
• If the plugin's "Enable Logs" setting is not essential for operational requirements, consider disabling it to eliminate the log file pollution vector associated with CVE-2026-14345.