CVE-2025-12000: WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnldeletelog() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12000?
CVE-2025-12000 is considered a high severity vulnerability due to its potential for arbitrary file deletion by authenticated attackers.
How do I fix CVE-2025-12000?
To fix CVE-2025-12000, update the WPFunnels plugin to version 3.6.3 or later where this vulnerability has been addressed.
Who is affected by CVE-2025-12000?
CVE-2025-12000 affects WPFunnels versions up to and including 3.6.2 when used in WordPress by authenticated users with Administrator-level access.
What type of attack does CVE-2025-12000 enable?
CVE-2025-12000 enables authenticated attackers to delete arbitrary files on the server due to insufficient file path validation.
What plugin is impacted by CVE-2025-12000?
CVE-2025-12000 impacts the WPFunnels plugin for WordPress.