Path Traversal in FunnelKit WordPress Plugin

Executive Summary

This vulnerability affects the FunnelKit WordPress plugin before version 3.15.0.6. It allows administrators to delete arbitrary .json files outside the intended directory through path traversal during a template-import operation. The plugin fails to validate user-supplied paths before deleting files, enabling attackers to use directory traversal sequences like '../' to delete critical files such as plugin configuration files.

Useful 0 Not Useful 0

Detection Guidance

Check if the FunnelKit plugin version is below 3.15.0.6 by inspecting the WordPress admin panel under Plugins. Look for unauthorized .json file deletions in server logs, particularly in the wp-content directory. Monitor for sudden plugin or theme failures which may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service by disabling plugins or themes. Attackers with administrator privileges can delete essential .json files, causing the affected plugins to malfunction or become unusable. The impact is limited to users with administrator access who can exploit this flaw.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by enabling denial of service attacks that disrupt WordPress plugins handling sensitive data. If critical plugins are disabled, it may lead to loss of functionality for systems processing personal or health information, potentially violating availability requirements in these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update the FunnelKit plugin to version 3.15.0.6 or later immediately. Remove unnecessary administrator accounts and restrict manage_options capability to trusted users only. Review server logs for signs of exploitation and restore any deleted .json files from backups.

Useful 0 Not Useful 0