WPFunnels RCE Bug (CVE-2026-14345): What to Do Now

If you use WPFunnels for WooCommerce, update it today: a critical, unauthenticated remote code execution bug (CVE-2026-14345, CVSS 9.8) lets an attacker plant malicious code on your site without logging in, then trigger it the moment you check your funnel logs.

This post is for WooCommerce store owners, agencies, and anyone running the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin. You'll get a plain-English breakdown of what the bug actually does, who's exposed, and the exact steps to lock it down today, whether or not a patched version exists yet.

What happened: the WPFunnels vulnerability explained

On 2026-07-07, this flaw was published to the National Vulnerability Database as CVE-2026-14345. It affects WPFunnels, a popular funnel-building plugin for WooCommerce used to create sales funnels, checkout pages, and one-click upsells.

The NVD rates it CRITICAL, CVSS 9.8 out of 10, with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain English, that string means:

• AV:N (Network): an attacker can exploit it over the internet, no physical or local access needed.
• AC:L (Low complexity): no special conditions or timing tricks required.
• PR:N (No privileges): the attacker doesn't need a login or account on your site.
• UI:N (No user interaction): the attacker doesn't need to trick anyone to plant the payload.
• C:H / I:H / A:H: if exploited, the attacker can fully read, change, or take down your site. That's about as bad as it gets.

The weakness is classified as CWE-434, a category covering unsafe handling of uploaded or written files that can end up containing executable code.

How the attack actually works

This isn't a simple "upload a shell" bug. It's a two-step chain, and understanding it is the key to protecting yourself right now.

1. Planting the payload. WPFunnels has an AJAX endpoint that accepts a postData parameter, used when a visitor submits a funnel step like an opt-in form. If your Log Settings has "Enable Logs" turned on, the plugin writes that postData value, unsanitized, straight into a .log file.
2. Triggering the payload. The plugin's admin-side log viewer (wpfnl_show_log) uses PHP's include_once to display that log file's contents in your WordPress dashboard. Because include_once executes any PHP code it finds, not just displays it, a log file "poisoned" with PHP code becomes a code-execution trigger the moment an admin opens it.

Here's the part that makes this critical rather than just annoying: you'd normally expect step 1 to require a login, since WordPress uses one-time security tokens called nonces to stop random strangers from hitting AJAX endpoints. But according to the NVD record, the nonce needed to reach this endpoint is printed in the page source of every public funnel step page. Anyone can grab it without an account. That means an attacker needs zero credentials to plant the malicious code; they just need your logging toggle on, and eventually, an admin to open the log viewer.

Who's affected

The NVD record doesn't list a fixed version number, which happens when a vendor fix lands after the initial report, or hasn't been confirmed back to NVD yet. Don't wait on that field: go check the plugin's own changelog directly.

What to do right now

Do these in order. None of them need a developer.

1. Update WPFunnels immediately. In your WordPress dashboard, go to Plugins → Installed Plugins and update WPFunnels to the newest available version. Then open the plugin's changelog, on its WordPress.org page or under Plugins → Installed Plugins → View details, and confirm it mentions a fix for log handling or postData sanitization. If it doesn't, and no newer version exists yet, treat the plugin as still at risk and move to step 2.
2. Turn off logging as an immediate mitigation. Go to WPFunnels → Settings → Log Settings and switch "Enable Logs" off. This breaks the attack chain at step 1, since nothing gets written to the log file if logging is disabled.
3. Don't open the log viewer until you've updated. Avoid using the Log Settings "View" option to inspect existing logs until you've confirmed a fix is installed. If a log file is already poisoned, opening it is exactly what triggers the code execution.
4. Delete any existing log file you're unsure about. If logging was enabled before you read this, treat the existing log as suspect. Deleting it, via your host's file manager or FTP under wp-content/uploads/ or the plugin's log directory, removes the risk of it ever getting triggered.
5. Check for signs you were already hit. Look for unfamiliar admin users, unexpected files in wp-content/uploads/, or your site redirecting visitors elsewhere. Our guide on how to tell if your website has already been hacked walks through the specific signs to check for.

Why this matters even if you don't remember enabling logging

A lot of WooCommerce store owners inherited their funnel setup from a developer, agency, or an earlier version of the site. "Enable Logs" is a debugging convenience, and it's common for it to get switched on during setup and never switched back off. If you didn't personally configure WPFunnels, that's exactly the moment to go check the toggle yourself rather than assume it's off.

This is also a good moment to zoom out. Plugin bugs like this are exactly why relying on WooCommerce's default setup isn't the same as having your store actually checked. Our free website security check flags outdated or risky plugins like this one, with no card details and no login required.

Quick checklist

• [ ] WPFunnels updated to the latest version
• [ ] Changelog confirms a fix for log handling or postData sanitization
• [ ] Log Settings "Enable Logs" is off, unless you've confirmed the fix is installed
• [ ] Existing log file reviewed or deleted before being viewed
• [ ] Admin user list checked for anything unfamiliar
• [ ] wp-content/uploads/ checked for unexpected files

FAQ

Is WPFunnels safe to use right now? Not in its default state if you're running version 3.12.7 or earlier with logging enabled, since the plugin has a confirmed critical vulnerability (CVE-2026-14345). It's safe to keep using once you've updated to a version whose changelog confirms the fix, or safe enough in the meantime if you turn off "Enable Logs" in Log Settings.

How do I fix the WPFunnels RCE bug? Update the plugin to the latest version from Plugins → Installed Plugins, then check its changelog for a mention of a log-handling or postData security fix. Until you've confirmed that, turn off Log Settings → Enable Logs and avoid opening the log viewer, since that step is what actually triggers the code execution.

What is CVE-2026-14345? It's the official vulnerability record for a critical remote code execution flaw in the WPFunnels WooCommerce plugin, published to the National Vulnerability Database on 2026-07-07 with a CVSS score of 9.8. It lets an attacker plant malicious code through a funnel form submission and trigger it when an admin later views the plugin's log file.

How do I protect my WooCommerce store from hackers in general, not just this bug? Keep every plugin and theme updated, remove ones you don't actively use, and lock down admin access with strong unique passwords and two-factor authentication. Pair that with a proper security header setup, check yours with our free security headers tool, and a periodic manual review, since automated scanners miss logic flaws like this one.

Is a WooCommerce plugin security update like this one urgent? Yes. A CVSS 9.8 unauthenticated remote code execution bug is about as serious as it gets, since it needs no account and no action from a victim to plant the attack. Treat any plugin update tied to a CVSS score above 9 as something to apply the same day, not on your next regular maintenance pass.

Key takeaways

• CVE-2026-14345 is a critical (CVSS 9.8), unauthenticated remote code execution bug in WPFunnels up to version 3.12.7, caused by unsanitized postData written into a log file that the plugin later includes with include_once.
• The attacker doesn't need a login to plant the payload: the nonce is publicly exposed on every funnel step page. They just need Log Settings "Enable Logs" on and an admin to eventually view the log.
• Update WPFunnels to the latest version today and confirm the changelog mentions a fix; if you can't confirm one yet, turn off Enable Logs and avoid opening the log viewer.
• Check for signs of prior compromise, like unfamiliar admins or unexpected files, before assuming you're clear.
• One plugin bug is rarely the whole story. A broader check of your store's attack surface is worth doing alongside this fix.

If you want a second set of eyes confirming WPFunnels, and everything else running on your store, is actually locked down and not just patched, a real person can manually audit your whole site for $49 through Circuit. It's not a replacement for updating the plugin today, but it catches the things a changelog can't tell you.