FunnelKit Automations CVE-2026-119163

Requires a WooCommerce store running the FunnelKit Automations plugin (<= 3.8.5.2) with its abandoned-cart module active and guest Store API checkout available. The attacker needs only a publicly obtainable WooCommerce cart nonce (no authentication) to submit a crafted bwfan_cart_id during checkout. The decisive limiting factor is that the injection does NOT execute at submission time: it is a persisted, blind, time-based attack that fires only when a scheduled Action Scheduler job later reloads the stored meta upon an order status transition out of pending, failed, or cancelled. Exploitation therefore depends on that subsequent status transition occurring and on blind timing-based inference, which slows and constrains data extraction.

Signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 7.5 and the PR:N confirms unauthenticated reach, but the vulnerability is a time-based BLIND SQL injection (C:H, I:N, A:N), so data extraction is slow and inferential, not a direct dump. Critically, the description establishes that exploitation is a two-step PERSISTED attack: the payload is stored during a guest Store API checkout but only executes when a scheduled Action Scheduler job later reloads the meta upon an order status transition out of pending, failed, or cancelled. That deferred, condition-dependent trigger meaningfully reduces real-world reliability and is why the vendor CVSS of 7.5 arguably overstates ease of exploitation. No EPSS score was supplied, the CVE is NOT in CISA KEV, and no public exploit code is referenced (the links are the Wordfence advisory, plugin source lines, and the fixing changeset). The vuln.today decision label is 'this_week' - a prioritized-but-not-emergency signal. Net: a genuine unauthenticated SQLi worth patching promptly, but current evidence points to it being a prompt-patch item rather than an actively-exploited emergency; absence of EPSS/KEV/POC means exploitation likelihood is inferred, not confirmed.

An unauthenticated attacker obtains a publicly available WooCommerce cart nonce, then submits a crafted bwfan_cart_id value during a guest Store API checkout, planting a malicious payload in stored order meta. Because the flaw is blind and time-based, the injected SQL only fires later when a scheduled Action Scheduler job reloads that meta on an order status transition out of pending, failed, or cancelled, at which point the attacker infers sensitive database contents (e.g., user credentials or secrets) from response timing. No public exploit code is identified in the provided references.