CVE-2025-26979: FunnelKit Funnel Builder LFI Vulnerability

CVE-2025-26979 Overview

CVE-2025-26979 is a PHP Local File Inclusion (LFI) vulnerability affecting the Funnel Builder by FunnelKit WordPress plugin. The vulnerability stems from improper control of filename for include/require statements in PHP, allowing attackers to include local files on the server. This type of vulnerability can lead to sensitive information disclosure, arbitrary code execution, and complete compromise of the affected WordPress installation.

Critical Impact

Attackers can exploit this Local File Inclusion vulnerability to read sensitive files, access configuration data, or potentially achieve remote code execution by chaining with other vulnerabilities or leveraging PHP wrappers.

Affected Products

• Funnel Builder by FunnelKit WordPress Plugin versions through 3.9.0
• WordPress installations running vulnerable FunnelKit plugin versions

Discovery Timeline

• 2025-02-25 - CVE-2025-26979 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-26979

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Funnel Builder by FunnelKit plugin fails to properly sanitize or validate user-controlled input before using it in PHP include or require statements. This allows an attacker to manipulate file paths and include arbitrary local files from the server's filesystem.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because they can expose sensitive configuration files such as wp-config.php, which contains database credentials and authentication keys. Additionally, attackers may leverage PHP stream wrappers to read file contents or, in certain configurations, escalate the attack to achieve code execution.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of user-supplied data that is subsequently used in PHP file inclusion operations. The plugin does not adequately restrict which files can be included through its functionality, allowing path traversal sequences or direct file path manipulation to access files outside the intended directory scope.

Attack Vector

The attack vector involves supplying malicious input to the vulnerable plugin functionality that handles file inclusion. An attacker can craft requests containing directory traversal sequences (e.g., ../) or absolute file paths to include sensitive local files. The inclusion of PHP files could result in code execution, while non-PHP files would have their contents disclosed.

The vulnerability can be exploited remotely through the WordPress interface, making it accessible to unauthenticated or authenticated attackers depending on the specific entry point within the plugin's functionality.

Detection Methods for CVE-2025-26979

Indicators of Compromise

• Unusual HTTP requests to WordPress containing path traversal sequences (e.g., ../, ..%2f)
• Web server logs showing attempts to access sensitive files like /etc/passwd or wp-config.php
• Unexpected file access patterns in PHP error logs referencing FunnelKit plugin files
• Requests to plugin endpoints with encoded or obfuscated file path parameters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts
• Monitor WordPress plugin activity logs for suspicious file inclusion patterns
• Deploy intrusion detection systems with signatures for PHP LFI exploitation attempts
• Review web server access logs for anomalous requests targeting FunnelKit plugin endpoints

Monitoring Recommendations

• Enable detailed logging for the FunnelKit plugin and WordPress core file operations
• Configure alerts for access attempts to sensitive system files from web application contexts
• Monitor for sudden changes in server file access patterns or unusual file read operations
• Implement file integrity monitoring on critical WordPress configuration files

How to Mitigate CVE-2025-26979

Immediate Actions Required

• Update Funnel Builder by FunnelKit plugin to a patched version newer than 3.9.0
• Review WordPress access logs for evidence of exploitation attempts
• Audit any custom configurations or integrations using the FunnelKit plugin
• Consider temporarily disabling the plugin if an immediate update is not possible

Patch Information

Users should update the Funnel Builder by FunnelKit WordPress plugin to the latest available version that addresses this vulnerability. The vulnerability affects all versions from the initial release through version 3.9.0. For detailed information about the vulnerability and patch status, refer to the Patchstack WordPress Vulnerability Database.

Workarounds

• Implement server-level restrictions using open_basedir PHP directive to limit file access scope
• Deploy a Web Application Firewall with rules blocking path traversal patterns
• Restrict access to the WordPress admin panel and plugin functionality to trusted IP addresses
• Use file permission hardening to prevent the web server from reading sensitive files outside the WordPress directory

# Example: Restrict PHP open_basedir in Apache configuration
<Directory "/var/www/html/wordpress">
    php_admin_value open_basedir "/var/www/html/wordpress:/tmp"
</Directory>