The FunnelKit WordPress plugin versions prior to 3.15.0.6 do not properly validate user-supplied file paths when deleting files during template import. This lack of validation enables an administrator user to perform path traversal attacks to delete arbitrary .json files outside the intended directory. Such unauthorized file deletions can disrupt the plugin's functionality, potentially causing denial of service conditions.

An attacker with administrator privileges can delete arbitrary .json files on the server outside the intended directory, potentially disabling the FunnelKit plugin or causing denial of service. There is no indication of remote exploitation without admin privileges or data disclosure beyond file deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only. Monitor for vendor updates regarding an official fix.