CVE-2026-12979
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The FunnelKit WordPress plugin before version 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation. This allows users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, potentially disabling other FunnelKit plugin functions (denial of service).
Risk Assessment
An attacker with administrator privileges can delete critical .json configuration files, causing the FunnelKit plugin or other dependent components to fail, resulting in e-commerce store downtime and revenue loss.
Recommendation
Immediately update the FunnelKit plugin to version 3.15.0.6 or later. Restrict administrator privileges to trusted users only.
Other vulnerabilities in FunnelKit
Original NVD description (English source)
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).