What is the CVSS score of CVE-2025-49034?

CVE-2025-49034 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Wordpress Plugin CVE-2025-49034

Q: Which versions of Wordpress Plugin are affected by CVE-2025-49034?

SQL injection in Aman Funnel Builder by FunnelKit WordPress plugin (versions through 3.10.2) allows attackers to execute arbitrary SQL commands against the site database.

HIGH

SQL Injection (CWE-89)

2025-07-16 audit@patchstack.com

WordPress SQLi Wordpress Plugin

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.6 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows SQL Injection.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.10.2.

AnalysisAI

SQL injection in Aman Funnel Builder by FunnelKit WordPress plugin (versions through 3.10.2) allows attackers to execute arbitrary SQL commands against the site database. The vulnerability affects an unspecified function that fails to properly sanitize or parameterize user-supplied input before inclusion in SQL queries. No CVSS score, EPSS probability (0.05%, 15th percentile) indicates low real-world exploitation likelihood at time of analysis, and no active exploitation via CISA KEV or public exploit code has been confirmed.

Technical ContextAI

This SQL injection vulnerability (CWE-89) stems from improper neutralization of special SQL metacharacters in user input. The Aman Funnel Builder by FunnelKit plugin is a WordPress plugin (CPE references WordPress ecosystem) that likely processes user-supplied parameters in funnel configuration, form submissions, or backend queries without parameterized prepared statements or input validation. The vulnerability allows an attacker to break out of the intended SQL query context and inject malicious SQL commands that execute with the database user's privileges, potentially leading to unauthorized data access, modification, or deletion.

Affected ProductsAI

Aman Funnel Builder by FunnelKit WordPress plugin is affected in all versions from an unspecified baseline through and including version 3.10.2. The plugin is distributed via the WordPress plugin repository and is identified by the slug 'funnel-builder.' CPE identification would follow the pattern cpe:2.3:a:funnelkit:funnel-builder:*:*:*:*:*:wordpress:*:* with version constraint <=3.10.2. Patch Stack database reference confirms the affected version range.

RemediationAI

Update Aman Funnel Builder by FunnelKit to a version greater than 3.10.2 immediately; the vendor advisory via Patch Stack (https://patchstack.com/database/Wordpress/Plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-10-2-sql-injection-vulnerability?_s_id=cve) indicates a patched version is available. If an immediate update is not feasible, review and restrict database user permissions for the WordPress application to limit lateral damage from SQL injection exploitation, and implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in request parameters. Monitor database query logs for anomalous activity.