CVE-2026-79631: CWE-200 Information Exposure in WPFunnels

CVE-2026-79631 is an information exposure vulnerability in the WPFunnels WordPress plugin before version 3.13.0. The plugin writes log files containing customer order details and opt-in form submissions to a predictable path within the public uploads directory. Because access to these log files is not properly restricted, unauthenticated attackers can download sensitive customer data if logging is enabled. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

Unauthenticated attackers can access sensitive customer information such as order details and opt-in form submissions by downloading exposed log files. This leads to information disclosure but does not affect integrity or availability.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling logging or restricting access to the uploads directory to prevent unauthorized access to log files.