Arbitrary File Deletion Vulnerability in WPFunnels Plugin for WordPress
CVE-2025-12000
6.5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 8 November 2025
What is CVE-2025-12000?
The WPFunnels plugin for WordPress suffers from a security flaw that enables authenticated users with Administrator-level access to exploit the wpfnl_delete_log() function. This lack of proper file path validation allows attackers to delete arbitrary files on the server. If critical files, such as wp-config.php, are deleted, it could result in severe consequences like remote code execution, jeopardizing the entire site.
Affected Version(s)
Easy WordPress Funnel Builder To Collect Leads And Increase Sales – WPFunnels * <= 3.6.2