CVE-2025-12000
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers with Administrator-level access and above to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Risk Assessment
An attacker with administrator privileges can delete critical files such as wp-config.php, potentially leading to remote code execution and full site compromise. The risk is high for sites running the vulnerable plugin version.
Recommendation
Update the WPFunnels plugin to a version later than 3.6.2. Limit the number of administrator accounts and maintain regular file backups.
Other vulnerabilities in WPFunnels
See all- CVE-2026-97271High
The WPFunnels plugin in versions up to and including 3.13.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by an unauthenticated attacker.
- CVE-2026-27371High
The WPFunnels plugin versions 3.13.1 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-14345Critical
The WPFunnels plugin for WordPress up to version 3.12.7 is vulnerable to Remote Code Execution via the 'postData' parameter. An unauthenticated attacker can write malicious data into a .log file, which is later included via include_once, allowing code execution on the server. Exploitation requires logging to be enabled and an administrator to view the polluted log file.
- CVE-2026-27062Medium
The WPFunnels plugin up to version 3.13.5 contains a Cross-Site Request Forgery (CSRF) vulnerability. It allows an attacker to force a logged-in user to perform unwanted actions.
- CVE-2026-118091Medium
The WPFunnels WordPress plugin (up to version 3.13.5) contains a missing authorization vulnerability enabling exploitation of incorrectly configured access control security levels. An unauthorized user may gain access to functions or data they should not have rights to.
- CVE-2026-118088Medium
The WPFunnels WordPress plugin (up to version 3.13.5) is vulnerable to a missing authorization flaw that allows exploitation of improperly configured access control security levels. The vulnerability enables unauthorized users to perform actions reserved for privileged roles.
- CVE-2026-62029Medium
The WPFunnels plugin for WordPress up to version 3.13.3 contains a stored XSS (Cross-site Scripting) vulnerability due to improper neutralization of input during web page generation.
- CVE-2026-97269Medium
Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels up to version 3.13.1 allows an attacker to access resources without authorization.
- CVE-2026-84908Medium
The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.12.13. The plugin registers the 'wpfnl_load_payment' AJAX action for both authenticated and unauthenticated users (wp_ajax_nopriv_) and the underlying add_offer_product_to_cart() function performs no nonce verification, no capability check, and no validation that the attacker-supplied product_id is the offer product actually configured on the attacker-supplied step_id. This makes it possible for unauthenticated attackers to add arbitrary WooCommerce products to a cart at any discounted price configured on any funnel step, enabling price manipulation and revenue loss at checkout.
- CVE-2026-79632Medium
The WPFunnels WordPress plugin before version 3.13.0 does not perform any authorization or nonce check in one of its opt-in submission handlers, and takes notification recipients and subject from the request. This allows unauthenticated users to make the site send emails to arbitrary recipients with an arbitrary subject.
Original NVD description (English source)
The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS