# CVE-2026-12979: FunnelKit WordPress plugin arbitrary file deletion in template importer

Source: https://junglewise.ai/threats/cve-2026-12979-funnelkit-wordpress-plugin-arbitrary-file-deletion-in-template  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-12979 · Severity: info · CVSS 5.5 · Published 2026-07-16

FunnelKit is a WordPress plugin used to build sales funnels and marketing automations. A security flaw in the plugin's template import feature allows an administrator to delete critical configuration files (specifically .json files) from the server. This could be used to disable other plugins, break website functionality, or cause a denial of service.

Technologies: [FunnelKit Funnel Builder](https://junglewise.ai/threats/technologies/funnel-builder). Vendors: [FunnelKit](https://junglewise.ai/threats/vendors/funnelkit).

## Quick answers

**Is CVE-2026-12979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12979 being exploited in the wild.

**How severe is CVE-2026-12979?** Informational severity, with a CVSS score of 5.5, published 16 July 2026.

**Which products and versions are affected?** FunnelKit Funnel Builder < 3.15.0.6.

**Is there a fix for CVE-2026-12979?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12979 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12979?** Check whether you run FunnelKit Funnel Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the FunnelKit Funnel Builder plugin's template importer. The 'step-import' REST handler fails to sanitize the 'builder' and 'template' request parameters, which are passed to the WFFN_Template_Importer::import_remote() method. By using '../' sequences, an authenticated user with administrator privileges (manage_options capability) can traverse outside the intended directory. The plugin then uses wp_delete_file() on the resulting path with a hard-coded .json extension. This allows for the deletion of any .json file reachable by the web server user, potentially leading to a denial of service or the disabling of other plugins and themes. The issue is fixed in version 3.15.0.6.

## Affected products

- FunnelKit FunnelKit Funnel Builder < 3.15.0.6

## Timeline

- 2026-06-25: disclosed: Publicly published by WPScan
- 2026-07-16: advisory: NVD published date

## References

- [https://wpscan.com/vulnerability/d81ca171-65eb-484d-917f-f41b0cd20351/](https://wpscan.com/vulnerability/d81ca171-65eb-484d-917f-f41b0cd20351/)

## Related threats

- [FunnelKit WordPress plugin reflected XSS in Divi Optin Form](https://junglewise.ai/threats/cve-2026-12978-funnelkit-wordpress-plugin-reflected-xss-in-divi-optin-form)
- [FunnelKit Funnel Builder Reflected XSS](https://junglewise.ai/threats/cve-2026-57816-funnelkit-funnel-builder-reflected-xss)
- [FunnelKit Funnel Builder SQL injection](https://junglewise.ai/threats/cve-2026-56052-funnelkit-funnel-builder-sql-injection)
- [FunnelKit Funnel Builder unauthenticated XSS](https://junglewise.ai/threats/cve-2026-48966-funnelkit-funnel-builder-unauthenticated-xss)
- [FunnelKit Funnel Builder unauthenticated SQL injection](https://junglewise.ai/threats/cve-2026-42381-funnelkit-funnel-builder-unauthenticated-sql-injection)