CVE-2026-13080 is a Local File Inclusion vulnerability in the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress, affecting all versions up to 3.12.7. The flaw exists due to improper control of the filename used in an include/require statement, specifically via the 'logKey' parameter. Authenticated attackers with administrator privileges can exploit this to include arbitrary PHP files, enabling execution of arbitrary code on the server. This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement). The CVSS v3.1 base score is 6.6, indicating a medium severity impact with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

Successful exploitation allows an attacker with administrator-level access to execute arbitrary PHP code on the server by including malicious PHP files. This can lead to bypassing access controls, unauthorized disclosure of sensitive data, and full remote code execution. The vulnerability requires authenticated access with high privileges, limiting the attack surface to trusted users or compromised administrator accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file uploads and inclusion. Avoid uploading PHP files or other executable content that could be included via the vulnerable parameter. Follow vendor channels for updates and apply patches promptly once released.