CVE-2026-12979

5.5 Moyenne

Publiée le 16/07/2026 à 09:16 · Modifiée le 16/07/2026 à 15:43 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The FunnelKit WordPress plugin before 3.15.0.6 does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other FunnelKit WordPress plugin before 3.15.0.6 or (denial of service).

Traduire en français

Produits concernés

Unknown FunnelKit

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-73

Références

https://wpscan.com/vulnerability/d81ca171-65eb-484d-917f-f41b0cd20351/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories