What is GHSA-cv99-jq97-cc3r?

GHSA-cv99-jq97-cc3r is a security advisory published by GitHub Security Advisories with Medium severity. The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes...

Which CVE IDs does GHSA-cv99-jq97-cc3r cover?

GHSA-cv99-jq97-cc3r covers the following CVE IDs: CVE-2026-79631. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cv99-jq97-cc3r?

GHSA-cv99-jq97-cc3r has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-cv99-jq97-cc3rMediumCVSS 5.3

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes...

Vendor

GitHub Security Advisories

Published

September 4, 2026

Last Modified

September 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-79631 →

📋 Description

The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-79631
https://wpscan.com/vulnerability/70d377d4-87d1-4f74-984d-f93eb5beaa2f
https://github.com/advisories/GHSA-cv99-jq97-cc3r