FunnelKit Funnel Builder EUVD-2026-38713

Exploitation requires (1) a WordPress site running the FunnelKit Funnel Builder plugin at version 3.15.0.5 or earlier, (2) network reachability to wp-admin or the plugin's AJAX/REST endpoints, and (3) an authenticated session at a high-privilege role (PR:H - typically Administrator or Shop Manager in WooCommerce terms) capable of reaching the vulnerable plugin handler. No user interaction by another party is required (UI:N) and attack complexity is low (AC:L), so once the privileged session exists, exploitation is deterministic. Limiting factors are the high-privilege precondition and that vulnerable endpoints are only present on sites with the plugin actively installed and enabled.

The CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) reflects a network-reachable, low-complexity attack that nonetheless requires high privileges (PR:H) - typically an admin or shop-manager role in WordPress - which materially limits realistic exploitation. The scope change (S:C) and high confidentiality impact (C:H) are the most concerning signals because injection in a privileged plugin context can read secrets across the WordPress database. No EPSS score, KEV listing, or POC was provided in the intelligence, so real-world exploitation pressure appears low and likely opportunistic rather than mass-targeted. Note that PR:H alongside 'Blind SQL Injection' is unusual for a customer-facing funnel plugin - if the actual entry point is a lower-privileged role (subscriber/customer), the real risk is materially higher than the vector suggests; verify with Patchstack's advisory.

An attacker who has already obtained or compromised a high-privilege WordPress account (administrator or shop manager) on a site running Funnel Builder ≤ 3.15.0.5 submits crafted input to a vulnerable plugin endpoint that is concatenated into a SQL query. Using boolean- or time-based blind techniques, they iteratively exfiltrate sensitive data such as wp_users.user_pass hashes, secret_keys, and customer PII from WooCommerce tables. No public POC was identified at time of analysis, but CWE-89 in WordPress plugins is well-understood and quickly weaponized once advisory details are published.