PT-2025-45544 · WordPress · Wpfunnels

Published 2025-11-08 · Updated 2025-11-08 · CVE-2025-12000

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPFunnels plugin for WordPress versions up to and including 3.6.2

Description The WPFunnels plugin for WordPress has a flaw that allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server. This is due to inadequate file path validation within the wpfnl delete log() function. Deleting specific files, such as wp-config.php, could lead to remote code execution.

Recommendations Update the WPFunnels plugin to a version newer than 3.6.2.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-12000

Affected Products

Wpfunnels

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12000 · Security Note
• https://twitter.com/CVEnew/status/1987011682141339915 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.6.1/admin/modules/settings/class-wpfnl-settings.php#L591 · Note
• https://t.me/cveNotify/142198 · Telegram Post
• https://t.me/CVEtracker/36853 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wpfunnels/tags/3.6.1/includes/core/logger/class-wpfnl-logger.php#L172 · Note
• https://plugins.trac.wordpress.org/changeset/3389604/wpfunnels/trunk/admin/modules/settings/class-wpfnl-settings.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d969eb46-b12a-4a36-9321-bf1479906a5d?source=cve · Note