The FunnelKit WordPress plugin before 3
The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).
CVSS Score
5.5
MEDIUM
Published
16 Jul 2026 07:16
Modified
16 Jul 2026 13:43
Source
CIRCL
CVSS v3 Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L
Attack Vector
Network
Complexity
Low
Privileges
High
Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
Low
Weaknesses (CWE)
CWE-73
Affected Systems
No vendor data available.
External Links
KEV Status
Not in CISA KEV catalog