What is the CVSS score of EUVD-2026-38713?

EUVD-2026-38713 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of FunnelKit Funnel Builder are affected by EUVD-2026-38713?

FunnelKit Funnel Builder for WordPress (versions ≤3.15.0.5) contains a blind SQL injection vulnerability accessible to high-privilege authenticated users, enabling extraction of sensitive database…

How to fix or mitigate EUVD-2026-38713?

Within 24 hours: Audit all WordPress instances running FunnelKit versions up to 3.15.0.5; list all high-privilege user accounts with access to the plugin. Within 7 days: Revoke high-privilege access for non-essential users; enable database-level SQL query logging and alerting for suspicious patterns; implement WAF rules targeting blind SQL injection signatures. Within 30 days: Contact vendor for patch timeline; prepare upgrade plan to patched version once available, or migrate to alternative funnel builder if vendor cannot provide timeline.

FunnelKit Funnel Builder EUVD-2026-38713

| CVE-2026-56052 HIGH

SQL Injection (CWE-89)

2026-06-24 Patchstack

GHSA-rj87-rfcc-35pw

WordPress SQLi Wordpress Plugin Funnel Builder By Funnelkit Funnelkit

7.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.6 HIGH

Network-reachable plugin endpoint (AV:N/AC:L) requires admin-level WordPress role (PR:H); blind SQLi reads cross-table data (S:C/C:H) with minor availability impact and no integrity change.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 08:00 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection.

This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.

AnalysisAI

Blind SQL injection in FunnelKit Funnel Builder for WordPress (versions up to and including 3.15.0.5) allows authenticated attackers with high privileges to inject arbitrary SQL queries against the underlying database. The flaw is reported by Patchstack and tracked as CWE-89; no public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. The CVSS scope change combined with confidentiality impact indicates database contents beyond the plugin context can be exfiltrated one bit at a time via blind techniques.

Technical ContextAI

FunnelKit Funnel Builder (formerly WooFunnels) is a WordPress plugin used to build sales funnels, checkout flows, and order bumps on top of WooCommerce. The CWE-89 root cause is Improper Neutralization of Special Elements in an SQL Command: user-controlled input is concatenated into a SQL statement without parameterized queries or proper escaping via wpdb->prepare(). Because the resulting query runs against the shared WordPress database (wp_users, wp_options, wp_usermeta), a successful injection can read data far outside the plugin's own tables. The CPE cpe:2.3:a:funnelkit:funnel_builder_by_funnelkit covers all builds from initial release through 3.15.0.5.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed from the supplied data - operators should upgrade FunnelKit Funnel Builder to the first release above 3.15.0.5 as soon as the vendor publishes it and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/funnel-builder/vulnerability/wordpress-funnel-builder-by-funnelkit-plugin-3-15-0-5-sql-injection-vulnerability for the exact fixed build. Until a patched version is installed, restrict who holds Administrator and Shop Manager roles, audit existing privileged accounts, and enforce strong MFA on wp-admin to reduce the chance that the high-privilege precondition is met. A WordPress WAF (Wordfence, Patchstack mu-plugin, or equivalent) with a virtual patch for this CVE can block the malicious payloads at the request layer, at the cost of false positives on legitimate admin queries; database-layer monitoring for UNION/SLEEP/BENCHMARK patterns in plugin queries provides defense-in-depth detection.