The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress contains a CWE-22 path traversal vulnerability in the wpfnl_delete_log() function. Authenticated attackers with Administrator privileges can exploit insufficient file path validation to delete arbitrary files on the server. This deletion capability can facilitate remote code execution by removing critical files necessary for WordPress operation. The vulnerability affects all versions up to and including 3.6.2. No known exploits are reported in the wild, and no patch or remediation details are currently available.

An attacker with Administrator-level access can delete arbitrary files on the server, potentially causing denial of service or enabling remote code execution by deleting critical files such as wp-config.php. This compromises the integrity and availability of the affected WordPress site and may lead to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to file deletions within the plugin. Consider disabling or removing the WPFunnels plugin if possible until a fix is available.