CVE-2026-12979mediumCWE-73

CVE-2026-12979: medium-severity vulnerability in FunnelKit

FunnelKit < 3.15.0.6 - Admin+ Arbitrary File Deletion via Path Traversal in Template Importer

Published

Follow this CVE+ Monitor FunnelKit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.5epss 0.3%
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
Affected products
Unknown · FunnelKit
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FunnelKit

In the same product, most dangerous first.

CVE-2026-12978HIGHFunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin FormEPSS 0.3%CVE-2025-2203MEDIUMWooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL InjectionEPSS 0.3%CVE-2025-10567MEDIUMFunnelKit < 3.12.0.1 - Reflected XSSEPSS 0.2%