Funnelkit Automations Email Marketing Automation And Crm For Wordpress Woocommerce
Monthly
Time-based blind SQL injection in FunnelKit Automations 3.8.5.2 and earlier allows unauthenticated attackers to append extra SQL to the plugin's existing queries and extract sensitive data from the WordPress database. Any store visitor who can obtain a publicly available WooCommerce cart nonce can submit a crafted bwfan_cart_id during a guest Store API checkout, but the payload is persisted rather than executed immediately and only fires when a scheduled Action Scheduler job reloads the stored meta on an order status transition out of pending, failed, or cancelled, making extraction blind and slow. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor scores it 7.5, while our assessment raises attack complexity to AC:H to reflect the deferred, second-order trigger and timing-based inference.
Time-based blind SQL injection in FunnelKit Automations 3.8.5.2 and earlier allows unauthenticated attackers to append extra SQL to the plugin's existing queries and extract sensitive data from the WordPress database. Any store visitor who can obtain a publicly available WooCommerce cart nonce can submit a crafted bwfan_cart_id during a guest Store API checkout, but the payload is persisted rather than executed immediately and only fires when a scheduled Action Scheduler job reloads the stored meta on an order status transition out of pending, failed, or cancelled, making extraction blind and slow. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor scores it 7.5, while our assessment raises attack complexity to AC:H to reflect the deferred, second-order trigger and timing-based inference.