The plugin allows an attacker to write arbitrary content into a PHP‑includeable .log file via the "postData" parameter. When an administrator later views the log, the plugin uses include_once to render that file, resulting in execution of the injected code. This file‑include vulnerability is classified as CWE‑434 and can lead to remote code execution on the server.

The flaw affects the WordPress plugin WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell from getwpfunnels, in all releases up to and including version 3.12.7.

With a CVSS score of 9.8 the issue is critical. The EPSS score is below 1%, indicating low reported exploitation probability, and it is not listed in CISA KEV. An unauthenticated attacker can inject malicious content as long as the plugin’s logging feature is enabled; the injected code only executes when an authenticated administrator opens the polluted log file through the plugin’s Log Settings View UI. Because unauthenticated injection is possible and the code will run upon admin interaction, the potential impact remains high for sites that keep logging enabled and have administrators who review logs.