Funnelkit CVE-2025-1562

This vulnerability presents exceptional real-world risk across multiple threat dimensions: (1) CVSS 9.8 with AV:N/AC:L/PR:N/UI:N demonstrates maximum exploitability - network-accessible, no authentication required, no user interaction needed, and unscoped impact; (2) the attack surface is enormous given WordPress's ubiquity and WooCommerce adoption; (3) arbitrary plugin installation directly enables Remote Code Execution (RCE) with full server privileges; (4) the flaw is straightforward to exploit programmatically without complex techniques; (5) the vulnerability affects unauthenticated attackers, making automated scanning and exploitation trivial. While specific EPSS and KEV status data were not provided in the input, the combination of pre-auth RCE capability, weak nonce protection (bypassable through timing or brute force), and missing authorization checks indicates this is actively exploitable and likely being weaponized. This is NOT a high-CVSS-but-low-risk issue - the attack vector (network, no privileges, no interaction) combined with immediate RCE impact places this in the critical priority tier requiring emergency patching.

An attacker sends a crafted HTTP POST request to a vulnerable WordPress site running FunnelKit ≤3.5.3, targeting the AJAX endpoint with action=install_or_activate_addon_plugins and a weak/guessable nonce. Due to missing capability validation, the request is processed without authentication. The attacker specifies a malicious plugin URL (e.g., hosted on attacker-controlled server containing a backdoor shell). WordPress downloads and installs the plugin automatically. The attacker then activates the malicious plugin through the same endpoint, achieving arbitrary code execution as the web server user. This can be accomplished in seconds with a single HTTP request, requiring no user interaction, no valid credentials, and no prior site access. The attacker can then create admin accounts, exfiltrate data, deploy ransomware, or pivot to other systems on the network. Mass exploitation would involve automated scanning for vulnerable FunnelKit installations followed by bulk malicious plugin injection.