CVE-2026-12979 – FunnelKit < 3.15.0.6 – Admin+ Arbitrary File Deletion via Path Traversal in Template Importer

CVE ID :CVE-2026-12979

Published : July 16, 2026, 7:16 a.m. | 18 minutes ago

Description :The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…