CVE-2026-12979

Name of the Vulnerable Software and Affected Versions FunnelKit WordPress plugin versions prior to 3.15.0.6

Description An issue exists during the template-import operation where the software fails to validate a user-supplied path before deleting a file. This allows users with administrator privileges to perform path traversal—a technique used to access files and directories that are stored outside the web root folder—to delete arbitrary .json files outside the intended directory. This action can lead to a denial of service by disabling the plugin.

Recommendations Update FunnelKit WordPress plugin to version 3.15.0.6 or later.