Executive brief
FunnelKit is a WordPress plugin used to build sales funnels and marketing automations. A security flaw in the plugin's template import feature allows an administrator to delete critical configuration files (specifically .json files) from the server. This could be used to disable other plugins, break website functionality, or cause a denial of service.
Technical details
A path traversal vulnerability exists in the FunnelKit Funnel Builder plugin's template importer. The 'step-import' REST handler fails to sanitize the 'builder' and 'template' request parameters, which are passed to the WFFN_Template_Importer::import_remote() method. By using '../' sequences, an authenticated user with administrator privileges (manage_options capability) can traverse outside the intended directory. The plugin then uses wp_delete_file() on the resulting path with a hard-coded .json extension. This allows for the deletion of any .json file reachable by the web server user, potentially leading to a denial of service or the disabling of other plugins and themes. The issue is fixed in version 3.15.0.6.
Affected products
- FunnelKit FunnelKit Funnel Builder < 3.15.0.6
Timeline
- 2026-06-25: disclosed: Publicly published by WPScan
- 2026-07-16: advisory: NVD published date