Funnel Builder CVE-2026-42381

No special conditions - remote unauthenticated exploitation against default configurations of Funnel Builder by FunnelKit versions ≤3.15.0.1 on any internet-reachable WordPress site with the plugin installed and activated. Limiting factors: the target site must have the plugin active (not merely installed), the vulnerable endpoint must be reachable (not blocked by a WAF or IP restrictions), and exploitation impact is bounded to confidentiality and limited availability per the CVSS vector (I:N indicates no direct write/modification through this vector). Specific affected request parameter and endpoint are not disclosed in the provided data and would need to be derived from the Patchstack advisory or vendor patch diff.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) signals a high-priority issue: network-reachable, low complexity, no privileges, no user interaction, with a scope change indicating impact beyond the vulnerable component (likely the broader WordPress database including users and other plugin tables). Confidentiality impact is High while integrity is rated None and availability Low - consistent with a read-oriented injection (e.g., UNION-based extraction) rather than full DML write. No EPSS score, KEV listing, or SSVC decision data was provided, and no public POC has been identified, so real-world exploitation likelihood cannot be quantified beyond the structural risk. Given WordPress plugins with pre-auth SQLi are routinely mass-scanned and weaponized by botnets within days of disclosure, treat this as urgent despite the absence of confirmed exploitation telemetry.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable Funnel Builder plugin endpoint on a public WordPress site, embedding malicious SQL into a parameter that is concatenated into a backend query. The injection enables extraction of sensitive data from wp_users (including hashed passwords and email addresses) and other tables across the WordPress database via UNION-based or boolean-based techniques. No public exploit identified at time of analysis, but the pre-auth nature and CWE-89 pattern make development of a working exploit straightforward for skilled actors.