CVE-2025-12000: WPFunnels WordPress Path Traversal Flaw

CVE-2025-12000 Overview

CVE-2025-12000 is an arbitrary file deletion vulnerability in the WPFunnels plugin for WordPress. The flaw resides in the wpfnl_delete_log() function, which fails to properly validate file paths before deletion. All versions of WPFunnels up to and including 3.6.2 are affected. Authenticated attackers holding Administrator-level access or higher can delete arbitrary files on the server. Deleting sensitive files such as wp-config.php can trigger the WordPress setup routine on the next site visit, enabling attacker-controlled database configuration and leading to remote code execution. The vulnerability is tracked under CWE-22: Path Traversal.

Critical Impact
Deletion of wp-config.php allows an attacker to reinitialize WordPress against an attacker-controlled database, resulting in full site takeover and remote code execution.

Affected Products

WPFunnels plugin for WordPress — all versions up to and including 3.6.2
WordPress sites with WPFunnels installed and Administrator or higher accounts exposed
Multi-author or agency WordPress environments where Administrator role is shared

Discovery Timeline

2025-11-08 - CVE-2025-12000 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12000

Vulnerability Analysis

The vulnerability exists in the wpfnl_delete_log() function within the WPFunnels logger component. The function accepts a file identifier from an authenticated request and passes it to a file deletion routine without validating that the resulting path stays within the plugin's log directory. Because path traversal sequences such as ../ are not stripped or rejected, an attacker can reference files anywhere on the filesystem reachable by the web server user. Reference implementations are visible in the class-wpfnl-settings.php file and the class-wpfnl-logger.php file.

Root Cause

The root cause is insufficient file path validation. The plugin trusts caller-supplied input to construct a filesystem path passed to a delete operation. There is no canonicalization step, no allowlist of permitted filenames, and no verification that the resolved path is contained within the intended log directory. This is a textbook path traversal weakness classified as [CWE-22].

Attack Vector

Exploitation requires an authenticated session with Administrator privileges. The attacker submits a crafted request to the plugin endpoint that invokes wpfnl_delete_log(), supplying a filename parameter that traverses out of the logs directory. When wp-config.php is deleted, subsequent visits to the site trigger WordPress installation, which allows the attacker to bind the site to a database they control. From there, arbitrary PHP execution is achievable through plugin or theme uploads.

No public proof-of-concept exploitation code is available. The vulnerability mechanism is described above based on the vendor changeset and public advisory; see the Wordfence Vulnerability Analysis for additional detail.

Detection Methods for CVE-2025-12000

Indicators of Compromise

Missing or recently deleted wp-config.php, .htaccess, or core WordPress files on a site running WPFunnels ≤ 3.6.2
WordPress installation screen (/wp-admin/install.php) appearing unexpectedly on a previously configured site
Administrator-account requests to WPFunnels log-deletion endpoints containing .., %2e%2e, or absolute paths in parameters
Unexpected WPFunnels plugin activity from Administrator accounts outside normal maintenance windows

Detection Strategies

Inspect web server access logs for POST or AJAX requests targeting WPFunnels admin actions that reference log file identifiers containing traversal sequences
Enable WordPress file integrity monitoring to alert on deletion of wp-config.php and files under wp-includes/ or wp-admin/
Correlate Administrator authentication events with subsequent filesystem deletion events on the web root

Monitoring Recommendations

Monitor filesystem audit logs for unlink() operations affecting paths outside the WPFunnels logs directory
Alert on any recreation of wp-config.php or new writes to the WordPress root directory
Track privileged user sessions and flag Administrator logins from new IP addresses or user agents

How to Mitigate CVE-2025-12000

Immediate Actions Required

Update WPFunnels to a version later than 3.6.2 that includes the fix from changeset #3389604
Audit all Administrator-level accounts and remove any that are unnecessary or inactive
Enforce multi-factor authentication on every Administrator account to reduce the risk of credential misuse
Verify the integrity of wp-config.php and core WordPress files, and restore from backup if tampering is suspected

Patch Information

The vendor addressed the vulnerability by adding file path validation to the wpfnl_delete_log() code path. Details of the fix are available in WordPress Plugin Changeset #3389604. Site owners should upgrade WPFunnels to the patched release published after version 3.6.2.

Workarounds

Deactivate and remove the WPFunnels plugin until the patched version can be installed
Restrict access to /wp-admin/ by IP allowlist at the web server or WAF layer
Set restrictive filesystem permissions so the web server user cannot delete files outside the plugin's expected directories
Deploy a web application firewall rule to block requests containing traversal sequences targeting WPFunnels endpoints

bash

# Example: block path traversal in WPFunnels admin-ajax requests at the WAF/nginx layer
location ~* /wp-admin/admin-ajax\.php {
    if ($arg_action ~* "wpfnl") {
        if ($args ~* "(\.\./|%2e%2e)") { return 403; }
    }
}