FunnelKit Automations CVE-2026-111411

The affected product is the FunnelKit Automations (wp-marketing-automations) WordPress plugin at versions from an unspecified start through 3.8.5.2. The available sources do not name the specific parameter, AJAX action, REST route, or plugin feature through which the SQL injection is triggered, so the precise trigger is not described in the available sources and cannot be stated as a concrete prerequisite. As scored (AV:N/AC:L/PR:N/UI:N), exploitation needs no authentication and no user interaction against a reachable installation; however, this unauthenticated rating is not confirmed by the description, and WordPress plugin SQLi flaws are commonly limited to authenticated low-privilege roles - this is the key limiting factor defenders should verify with the vendor, since if authentication is in fact required, real-world exposure is substantially narrower than the raw score suggests.

This is a genuine high-priority issue, not a high-CVSS/low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable flaw of low attack complexity requiring no privileges and no user interaction, which for a WordPress plugin means any internet-facing site running FunnelKit Automations is reachable by an unauthenticated remote attacker; combined with the base score of 9.3 and the vuln.today 'act_now' decision label sourced from Patchstack, remediation should be treated as urgent rather than deferred. The exploitation signals are partly incomplete and partly internally inconsistent: no EPSS probability was supplied, so widespread-versus-targeted exploitation likelihood cannot be quantified; the CVE is not listed in CISA KEV in the provided data, so there is no confirmation of active exploitation; and the only reference is a Patchstack advisory database entry, which documents the vulnerability but is not verified working exploit code. One concrete inconsistency to verify: the supplied vector sets S:C, C:H, I:N and A:L, yet the flaw is described purely as Blind SQL Injection (CWE-89), for which impact is normally confidentiality-dominated (data inference) with scope typically unchanged - the A:L (availability) component and the scope change are not explained by the description and should be confirmed against the Patchstack advisory. The PR:N (unauthenticated) rating also drives much of the score but is not corroborated by the description, which names no endpoint or privilege level; WordPress plugin SQLi flaws are frequently reachable only by authenticated low-privilege roles, so the unauthenticated assumption materially affects real-world exposure and warrants vendor verification.

A remote attacker sends crafted HTTP requests containing malicious SQL fragments to the vulnerable FunnelKit Automations input, and because the injection is blind, infers database contents bit-by-bit from differences in application responses or timing, progressively extracting sensitive WordPress data such as user records, password hashes, and session or API secrets. The CVSS vector rates this as low-complexity and, as scored, unauthenticated, so no special attacker position is needed; however, no verified working exploit code was identified in the supplied sources - only a Patchstack advisory reference.