CVE-2025-12000: Getwpfunnels Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The WPFunnels plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpfnl_delete_log() function in all versions up to, and including, 3.6.2. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Affected products

• Getwpfunnels Wpfunnels – Funnel Builder For Woocommerce With Checkout & One Click Upsell: up to and including 3.6.2

Published 2025-11-08. Last modified 2026-10-07.