The WPFunnels plugin allows an authenticated administrator to delete any file on the server because the file path is not validated in the wpfnl_delete_log() function. The attacker can target critical system files such as wp-config.php, which can lead to remote code execution if the configuration file is removed or tampered with. The weakness is a classic path‑traversal flaw (CWE‑22) and requires administrative credentials to exploit.

The vulnerability affects the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin from the getwpfunnels vendor. All releases up to and including 3.6.2 are impacted; newer releases are expected to have fixed the flaw.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of 1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, but it remains exploitable by authenticated users with administrator rights, which is a common role in many WordPress sites. The path traversal flaw enables deletion of arbitrary files, making the potential impact high if vital configuration files are removed.