Funnelkit Automations
Monthly
Unauthenticated PHP object injection in the FunnelKit Automations WordPress plugin through 3.8.6.1 lets network attackers reach a deserialization path without credentials or user interaction, carrying a 9.8 CVSS rating for potential high confidentiality, integrity, and availability impact. The available sources do not describe the specific vulnerable input or confirm a POP gadget chain that would turn object injection into code execution, so impact beyond object injection is not demonstrated. No public exploit identified at time of analysis, but the act_now priority and severe rating justify urgent review.
Blind SQL injection in the WordPress plugin FunnelKit Automations (wp-marketing-automations) through version 3.8.5.2 lets remote attackers pass crafted SQL through a plugin input and infer database contents, exposing WordPress user credentials, session tokens and stored marketing/automation data. The vulnerability carries a 9.3 vendor-side CVSS score, while the independent assessment scores it as scope-unchanged with high confidentiality impact only (no integrity or availability effect); because the sources do not name the vulnerable parameter, AJAX action or REST route, the unauthenticated (PR:N) rating cannot be confirmed from the description, and WordPress plugin SQLi flaws are frequently limited to low-privilege authenticated roles - verifying that prerequisite is the decisive exposure question. No public exploit code has been identified at time of analysis, but the issue is flagged act_now priority and a public PoC reference may appear quickly given the plugin's wide install base.
Cross-site request forgery in the FunnelKit Automations WordPress plugin (wp-marketing-automations) affects every release through 3.8.5.2 and lets an attacker induce a logged-in privileged user - typically an administrator or plugin operator - to submit state-changing requests against the site without their intent. The issue carries CVSS 3.1 score 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because successful forgery can compromise confidentiality and integrity, but it cannot succeed without that victim interaction on an active, authenticated session. Reported by Patchstack and assigned a vuln.today priority of 'this_week'; no public exploit code and no confirmed active exploitation (CISA KEV) are indicated in the available data.
Broken authentication in the FunnelKit Automations WordPress plugin (versions <= 3.7.3) allows authenticated low-privilege users (subscribers) to bypass intended authentication controls, leading to integrity tampering and availability impact on the WordPress site. The flaw is reported by Patchstack and tracked as EUVD-2026-36929, with no public exploit identified at time of analysis and no CISA KEV listing. Given subscriber-level registration is open on many WordPress sites, the practical attack surface is broader than the CVSS 7.1 score alone suggests.
The FunnelKit Automations - Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The FunnelKit Automations - Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The FunnelKit plugin for WordPress (versions ≤3.5.3) contains a critical vulnerability allowing unauthenticated attackers to install arbitrary plugins due to missing capability checks and weak nonce validation in the install_or_activate_addon_plugins() function. This is a pre-authentication remote code execution vector with a CVSS 9.8 severity rating that enables complete site compromise through malicious plugin installation.
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows SQL Injection.1.2. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated PHP object injection in the FunnelKit Automations WordPress plugin through 3.8.6.1 lets network attackers reach a deserialization path without credentials or user interaction, carrying a 9.8 CVSS rating for potential high confidentiality, integrity, and availability impact. The available sources do not describe the specific vulnerable input or confirm a POP gadget chain that would turn object injection into code execution, so impact beyond object injection is not demonstrated. No public exploit identified at time of analysis, but the act_now priority and severe rating justify urgent review.
Blind SQL injection in the WordPress plugin FunnelKit Automations (wp-marketing-automations) through version 3.8.5.2 lets remote attackers pass crafted SQL through a plugin input and infer database contents, exposing WordPress user credentials, session tokens and stored marketing/automation data. The vulnerability carries a 9.3 vendor-side CVSS score, while the independent assessment scores it as scope-unchanged with high confidentiality impact only (no integrity or availability effect); because the sources do not name the vulnerable parameter, AJAX action or REST route, the unauthenticated (PR:N) rating cannot be confirmed from the description, and WordPress plugin SQLi flaws are frequently limited to low-privilege authenticated roles - verifying that prerequisite is the decisive exposure question. No public exploit code has been identified at time of analysis, but the issue is flagged act_now priority and a public PoC reference may appear quickly given the plugin's wide install base.
Cross-site request forgery in the FunnelKit Automations WordPress plugin (wp-marketing-automations) affects every release through 3.8.5.2 and lets an attacker induce a logged-in privileged user - typically an administrator or plugin operator - to submit state-changing requests against the site without their intent. The issue carries CVSS 3.1 score 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) because successful forgery can compromise confidentiality and integrity, but it cannot succeed without that victim interaction on an active, authenticated session. Reported by Patchstack and assigned a vuln.today priority of 'this_week'; no public exploit code and no confirmed active exploitation (CISA KEV) are indicated in the available data.
Broken authentication in the FunnelKit Automations WordPress plugin (versions <= 3.7.3) allows authenticated low-privilege users (subscribers) to bypass intended authentication controls, leading to integrity tampering and availability impact on the WordPress site. The flaw is reported by Patchstack and tracked as EUVD-2026-36929, with no public exploit identified at time of analysis and no CISA KEV listing. Given subscriber-level registration is open on many WordPress sites, the practical attack surface is broader than the CVSS 7.1 score alone suggests.
The FunnelKit Automations - Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.6.4.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
The FunnelKit Automations - Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including,. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The FunnelKit plugin for WordPress (versions ≤3.5.3) contains a critical vulnerability allowing unauthenticated attackers to install arbitrary plugins due to missing capability checks and weak nonce validation in the install_or_activate_addon_plugins() function. This is a pre-authentication remote code execution vector with a CVSS 9.8 severity rating that enables complete site compromise through malicious plugin installation.
The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin before 3.3.0 does not sanitize and escape the bwfan-track-id parameter before. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows SQL Injection.1.2. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.