5.5
Medium
CVE-2026-12979 The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a…
Description
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FunnelKit 3.15 | earliest → < 3.15.0.6 | 3.15.0.6 |
Other CVEs of FunnelKit
The 4 CVEs of FunnelKit →
CVE-2026-12978
The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into…
7.1
High
CVE-2025-10567
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its…
6.3
Medium
CVE-2025-2203
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL…
6.1
Medium