Path Traversal in Getwpfunnels Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell

CVE-2025-12000

The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.007 (50.0th percentile) — read the EPSS interpretation.