CVE-2026-14345 is a remote code execution vulnerability in the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell WordPress plugin. The issue is caused by unsanitized attacker-controlled data from the 'postData' parameter being written into a .log file that is subsequently included via include_once in the wpfnl_show_log function. Because the log file is PHP-includeable, an attacker can inject arbitrary PHP code. The injection can be performed without authentication since the nonce required for the optin endpoint is publicly available on funnel step pages. However, exploitation requires that the plugin's 'Enable Logs' setting is active and that an administrator views the compromised log file through the plugin's UI, triggering code execution on the server. No official patch or remediation level is currently documented.

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the server hosting the WordPress site, leading to full compromise of the affected system. This can result in complete loss of confidentiality, integrity, and availability of the site and potentially the underlying server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable the 'Enable Logs' feature in the plugin settings to prevent log file pollution and avoid administrators opening the log view UI. Monitoring for updates from the vendor or security advisories is critical to apply an official fix once released.