FunnelKit < 3.15.0.6 – Admin+ Arbitrary File Deletion via Path Traversal in Template Importer | CVE 2026-12979

Description

The plugin does not validate a user-supplied path before deleting a file during a template-import operation, allowing users with administrator privileges to delete arbitrary .json files outside the intended directory through path traversal, which can disable other plugins or themes (denial of service).

Proof of Concept

FunnelKit Funnel Builder <= 3.15.0.5 - Admin+ arbitrary file deletion via path traversal in the template importer. The step-import REST handler reads the builder/template request values via sanitize_text_field() only (no ../ stripping) and passes them to WFFN_Template_Importer::import_remote(), which builds the path by concatenation and, if the file exists, reads then deletes it with wp_delete_file() and a hard-coded .json suffix, with no basename()/realpath() confinement.

Actor: Administrator (manage_options). The REST route's permission_callback resolves to the 'funnel'/'write' capability, which maps to administrator/manage_options.

== Environment preparation ==
1. FunnelKit Funnel Builder active (with WooCommerce). At least one funnel exists.
2. Precondition (verified to be required): the base directory wp-content/uploads/wffn_templates/<builder>/<step>/ must already exist so the OS can resolve the ../ traversal (file_exists() must succeed). This directory is created automatically the first time any template is imported for that builder/step (normal usage; an admin attacker can trigger it by importing one template). With the directory absent, the deletion does not fire.
3. Place a sentinel to prove out-of-tree deletion, e.g. wp-content/uploads/SENTINEL-victim.json.

== Exploit ==
As an administrator (application password or session cookie + REST nonce), send a single funnel-step import whose builder/template carry the traversal. Use a builder value whose wffn_templates/<builder>/landing/ directory exists (e.g. "divi" or "elementor"); replace 1 with any existing funnel id:

curl -k -u 'adminuser:APPLICATION_PASSWORD' \
  -X POST 'https://victim.example/wp-json/funnelkit-app/funnels/1/steps' \
  -H 'Content-Type: application/json' \
  -d '{"funnel_id":1,"type":"landing","title":"poc","builder":"divi","template":"../../../SENTINEL-victim"}'

The plugin builds wp-content/uploads/wffn_templates/divi/landing/../../../SENTINEL-victim.json, which resolves to wp-content/uploads/SENTINEL-victim.json, reads it, then deletes it.

== Expected result ==
After the request, wp-content/uploads/SENTINEL-victim.json has been deleted. (The HTTP response is a 500 from a downstream import fatal because the deleted file is not a valid template, but the deletion has already completed.) Increasing the number of ../ segments reaches any .json file the web-server user can unlink (for example a plugin's block.json, breaking that plugin's blocks).