Description
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WPFunnels | 2.6.0 – < 3.13.0 | 3.13.0 |
References
- https://wpscan.com/vulnerability/70d377d4-87d1-4f74-984d-f93eb5beaa2f/ exploit vdb-entry technical-description