CVE-2026-12979: FunnelKit Path Traversal Vulnerability

CVE-2026-12979 Overview

CVE-2026-12979 is a path traversal vulnerability in the FunnelKit WordPress plugin before version 3.15.0.6. The plugin fails to validate a user-supplied path before deleting a file during a template-import operation. An authenticated attacker with administrator privileges can delete arbitrary .json files outside the intended plugin directory. Successful exploitation can disable other WordPress plugins or cause a denial of service on the site. The flaw is categorized under CWE-73: External Control of File Name or Path.

Critical Impact
An administrator-level attacker can traverse the filesystem and delete arbitrary .json configuration files, disabling plugins and disrupting site functionality.

Affected Products

FunnelKit WordPress plugin versions prior to 3.15.0.6
WordPress sites using FunnelKit template-import functionality
Multi-tenant WordPress environments where administrator accounts are shared or delegated

Discovery Timeline

2026-07-16 - CVE-2026-12979 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in the NVD database

Technical Details for CVE-2026-12979

Vulnerability Analysis

The FunnelKit plugin exposes a template-import operation that accepts a file path from the administrator user. The handler passes this input directly to a file deletion routine without normalizing or constraining it to the plugin's expected working directory. As a result, path traversal sequences such as ../ allow the deletion target to escape the intended directory. The impact is limited to files with a .json extension, but many WordPress plugins and themes rely on .json files for configuration, translations, block metadata, or state. Removing these files can render other plugins non-functional or trigger fatal errors, producing a denial of service.

Root Cause

The root cause is missing input validation on the file path parameter used by the template-import routine. The code does not canonicalize the supplied path, does not enforce an allowlist of directories, and does not verify that the resolved path remains within the plugin's template directory before invoking the delete operation. This maps directly to CWE-73, external control of file name or path.

Attack Vector

Exploitation requires an authenticated session with administrator privileges on the target WordPress site. The attacker issues a template-import request that includes a traversal payload in the path parameter, for example a value resolving to ../../wp-content/plugins/<target-plugin>/config.json. The vulnerable handler resolves and deletes the file. Repeating the request against additional targets amplifies the impact. No user interaction beyond the attacker's own request is required, and no network conditions beyond normal HTTP access to the WordPress admin interface apply.

No public proof-of-concept code is referenced in the advisory. Additional technical detail is available in the WPScan Vulnerability Advisory.

Detection Methods for CVE-2026-12979

Indicators of Compromise

Unexpected deletion of .json files under wp-content/plugins/ or wp-content/themes/ directories
WordPress error logs showing fatal errors from plugins referencing missing .json configuration or block metadata files
HTTP POST requests to FunnelKit template-import endpoints containing ../ or URL-encoded %2e%2e%2f sequences in path parameters
Administrator sessions initiating template-import actions from unusual IP addresses or outside normal maintenance windows

Detection Strategies

Inspect web server access logs for requests to FunnelKit import handlers that include traversal characters in query or body parameters
Enable WordPress audit logging to record file operations initiated by administrator accounts
Deploy file integrity monitoring on the wp-content tree and alert on unauthorized deletions of .json files
Correlate plugin activation state changes with recent template-import requests

Monitoring Recommendations

Baseline the expected inventory of .json files under wp-content/ and alert on deviations
Forward WordPress and web server logs to a centralized analytics platform for retention and query
Monitor administrator account creation, promotion, and session activity for anomalies preceding import operations
Track FunnelKit plugin version across the estate and flag hosts still running versions before 3.15.0.6

How to Mitigate CVE-2026-12979

Immediate Actions Required

Upgrade the FunnelKit WordPress plugin to version 3.15.0.6 or later on every affected site
Audit WordPress administrator accounts and remove or downgrade any that are unnecessary or dormant
Enforce multi-factor authentication for all administrator accounts to reduce the risk of account takeover
Review recent template-import activity and file deletions to confirm no exploitation has occurred

Patch Information

The vendor has addressed the vulnerability in FunnelKit version 3.15.0.6. Site operators should update through the WordPress plugin manager or by deploying the fixed release from the vendor's distribution channel. Refer to the WPScan Vulnerability Advisory for advisory metadata and fixed-version confirmation.

Workarounds

Temporarily deactivate the FunnelKit plugin on sites that cannot be updated immediately
Restrict administrator access to trusted source IP ranges using web server or WAF rules
Deploy a web application firewall rule that blocks requests to FunnelKit import endpoints containing ../ or encoded traversal sequences
Take verified backups of the wp-content directory so any deleted .json files can be restored quickly

bash

# Configuration example: block path traversal payloads to FunnelKit import endpoints
# Example ModSecurity rule
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1002979,\
    msg:'CVE-2026-12979 FunnelKit path traversal attempt'"
    SecRule ARGS "@rx (\.\./|%2e%2e%2f|%2e%2e/)" \
        "t:none,t:lowercase,t:urlDecodeUni"