FunnelKit CVE-2026-12979

Exploitation requires an authenticated WordPress administrator account (PR:H confirmed by CVSS vector). The FunnelKit plugin must be installed and active on the target site at a version below 3.15.0.6. The attacker must have access to FunnelKit's template-import feature within the WordPress admin panel. Only files with a .json extension are deletable through this vector - arbitrary binary or PHP files cannot be targeted. Deletion is further constrained to files accessible by the web server process user, which is typically limited to the WordPress directory tree and its subdirectories. No network-level prerequisites beyond HTTPS access to the WordPress admin panel (wp-admin) are required once admin credentials are held. The key limiting factor is the PR:H requirement: unauthenticated or subscriber/editor-level users cannot exploit this flaw, making it unsuitable for opportunistic mass exploitation against uncompromised sites.

The CVSS base score of 5.5 (Medium) is grounded in PR:H, which substantially limits the attacker pool to authenticated WordPress administrators - a small, privileged group. In typical single-tenant deployments this significantly reduces real-world risk, since a rogue admin already possesses many destructive capabilities. However, risk escalates meaningfully in multi-tenant environments (managed WordPress hosting, agency-managed sites) where an attacker who compromises one admin account could silently degrade plugin functionality across multiple co-hosted installations by chaining .json file deletions. The publicly available POC (confirmed by WPScan) lowers the skill threshold for exploitation, but the PR:H requirement prevents unauthenticated mass exploitation. No EPSS score was provided, and the absence of a CISA KEV listing indicates no confirmed widespread in-the-wild exploitation at time of analysis. The S:C metric is the most operationally significant signal: the blast radius extends beyond FunnelKit itself to any WordPress plugin whose configuration is stored in a .json file reachable by the web server process. The integrity impact (I:L) may be conservatively scored given that file deletion is permanent without a backup; defenders should treat file-system impact as potentially higher in production environments without automated backup.

An attacker who has obtained WordPress administrator credentials - via credential stuffing, phishing, or account takeover - logs into the WordPress admin panel of a site running FunnelKit prior to 3.15.0.6. During a template-import operation, the attacker submits a crafted file path containing traversal sequences (e.g., ../../woocommerce/data/countries.json) as the deletion target. FunnelKit passes this unsanitized path directly to a file-deletion routine, permanently removing the targeted .json configuration file belonging to another plugin. A publicly available exploit demonstrates this technique, requiring no special tooling beyond authenticated access to the WordPress admin interface.