CVE-2026-12979 FunnelKit CVE debrief

Who should care

Administrators using FunnelKit WordPress plugin before 3.15.0.6 should update to prevent potential denial of service via path traversal. Additionally, security teams and vulnerability management teams should review the CVE record and NVD detail page to assess the vulnerability's impact on their organization.

Technical summary

The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation. This allows users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal. The vulnerability can cause a denial of service and affects administrators using the plugin. Defenders should focus on updating the plugin and restricting administrator privileges.

Defensive priority

High priority for administrators of FunnelKit WordPress plugin before 3.15.0.6 due to potential for denial of service.

Recommended defensive actions

• Update FunnelKit WordPress plugin to version 3.15.0.6 or later
• Restrict administrator privileges to trusted users
• Monitor for suspicious file deletion activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited; verify vulnerability with official records and monitor for updates. Affected product deployments should be reviewed for potential exposure. The CVE record and NVD detail page provide key information for defenders. However, additional verification steps are necessary to confirm the vulnerability's impact.

Official resources