What is the CVSS score of CVE-2025-14169?

CVE-2025-14169 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of FunnelKit Funnel Builder are affected by CVE-2025-14169?

FunnelKit's Funnel Builder for WooCommerce Checkout plugin (versions up to and including 3.13.1.5) contains an unauthenticated SQL injection vulnerability that could allow attackers to extract…

How to fix or mitigate CVE-2025-14169?

Within 24 hours, disable the FunnelKit Funnel Builder for WooCommerce Checkout plugin on all sites running versions up to and including 3.13.1.5 if business operations permit, or deploy a web application firewall (WAF) rule to block SQL injection attempts targeting the 'opid' parameter and monitor logs for exploitation attempts. Within 7 days, check the vendor's advisory and plugin repository for an official patch; if a fix is released, apply it immediately, and if not, consider applying the committed trunk fix in a test environment and deploying to production after validation. Within 30 days, ensure all instances are updated to the patched version once available, conduct a security review of database access logs for signs of compromise, and rotate credentials if any suspicious activity is detected.

FunnelKit Funnel Builder CVE-2025-14169

HIGH

SQL Injection (CWE-89)

2025-12-12 security@wordfence.com

WordPress SQLi Woocommerce Wordpress Plugin

7.5

CVSS 3.1 · Vendor: wordfence

Severity by source

Vendor (wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable SQL injection (AV:N/AC:L/PR:N/UI:N) enabling database read; blind SQLi yields confidentiality impact only, so C:H with I:N/A:N and no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (wordfence).

CVSS VectorVendor: wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 07, 2026 - 21:40 vuln.today

tag: Woocommerce added

Analysis Generated

Oct 07, 2026 - 20:44 vuln.today

CVE Published

Dec 12, 2025 - 08:15 cve.org

HIGH 7.5

DescriptionCVE.org

The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all versions up to, and including, 3.13.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

Unauthenticated time-based blind SQL injection in FunnelKit's Funnel Builder for WooCommerce Checkout, affecting all versions up to and including 3.13.1.5, lets remote attackers inject arbitrary SQL through the 'opid' parameter and read sensitive data from the underlying WordPress database, including user credentials and plugin/optin tables. The flaw is fully pre-authentication (CVSS 3.1: AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, base 7.5) and needs no non-default configuration - only an active, internet-reachable site running the vulnerable plugin, since the optin DB class passes the parameter into a query without escaping or preparation. Impact is real but tempered: extraction is blind and timing-based, so it is slow and noisy rather than a bulk dump, EPSS is low at 0.38% (29th percentile), no CISA KEV listing and no public exploit code were identified at time of analysis, and the upstream fix is already committed in the plugin's trunk.

Technical ContextAI

The issue is a classic CWE-89 SQL injection in the WordPress plugin FunnelKit Funnel Builder for WooCommerce Checkout. The referenced code at tags/3.13.1.5 - modules/optins/admin/db/class-wffn-db-optin.php (around line 79) and the optin merge-tag handling in modules/optins/merge-tags/class-bwf-optin-tags.php (around line 126) - takes the user-supplied 'opid' parameter and concatenates it into an existing query without adequate escaping and without using the WordPress database abstraction layer's parameterized prepare() mechanism. Because the query remains syntactically valid while returning results, the injected payload does not need to produce visible output, which is why the vulnerability manifests as time-based blind SQLi: attackers use conditional time delays (for example SLEEP() driven by substring comparisons) to infer database contents one bit at a time. The attack surface is the optin feature's publicly reachable request handling, so the injection is exploitable before authentication on any site with the plugin active. The plugin is distributed through the WordPress.org repository, where the linked changeset (new=3415550, old=3414128 on the funnel-builder trunk) records the upstream fix, and Wordfence's threat-intel advisory (fb19f920-0fd0-491e-9e87-62c828cad9b9) documents the report. The blind, timing-dependent nature of the technique means exploitation generates many slow HTTP requests, making it detectable through rate-limiting and latency/anomaly monitoring even though no special privileges are required.

Affected ProductsAI

FunnelKit - Funnel Builder for WooCommerce Checkout (WordPress plugin, slug 'funnel-builder') versions up to and including 3.13.1.5 are affected; the vulnerability exists in the optin module's database class and merge-tag handling. No CPE strings were supplied in the available intelligence, but the vendor tag used for code review - plugins.trac.wordpress.org/browser/funnel-builder/tags/3.13.1.5 - confirms 3.13.1.5 as a vulnerable release, and the description states all earlier versions are affected as well ('all versions up to, and including, 3.13.1.5'). The upstream code change that addresses the flaw is captured in the WordPress.org changeset for the funnel-builder trunk (changeset 3415550, previous revision 3414128), and the vendor-adjacent advisory from Wordfence is available at https://www.wordfence.com/threat-intel/vulnerabilities/id/fb19f920-0fd0-491e-9e87-62c828cad9b9?source=cve. Sites running the plugin behind a caching layer or with the optin module disabled may have reduced exposure, but the plugin's own version is the determining factor.

RemediationAI

Upstream fix available (changeset/commit in the WordPress.org plugin repository); a released patched version number is not independently confirmed from the provided data, so administrators should update to the newest FunnelKit Funnel Builder release beyond 3.13.1.5 via the WordPress plugin updater and verify the installed version, or remove/deactivate the plugin if it is not required. The code changes addressing the unsafe 'opid' handling are visible in the funnel-builder trunk changeset (new=3415550, old=3414128), and the original vulnerability report is documented by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/fb19f920-0fd0-491e-9e87-62c828cad9b9?source=cve. Until the update is applied, deploy a WAF rule that blocks or inspects requests carrying SQL metacharacters (quotes, comment sequences, SLEEP/BENCHMARK patterns) in the 'opid' parameter or against the plugin's optin endpoints - the trade-off is possible false positives on legitimate optin submissions and no protection if traffic bypasses the WAF. Because the injection is time-based and blind, add rate limiting and latency/anomaly alerting on requests that include 'opid'; this raises the cost of extraction and provides detection, but does not remove the underlying flaw and can throttle legitimate optin traffic. Restricting direct access to the optin/admin DB endpoints at the web layer (or disabling the optin feature entirely if unused) removes the attack surface at the cost of losing that checkout/funnel functionality, and it should be treated as a temporary measure rather than a substitute for patching.