5.5
Moyenne
CVE-2026-12979 The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a…
Description
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| FunnelKit 3.15 | premières → < 3.15.0.6 | 3.15.0.6 |
Autres CVE de FunnelKit
Les 4 CVE de FunnelKit →
CVE-2026-12978
The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into…
7.1
Élevée
CVE-2025-10567
The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its…
6.3
Moyenne
CVE-2025-2203
The FunnelKit WordPress plugin before 3.10.2 does not sanitize and escape a parameter before using it in a SQL…
6.1
Moyenne