Missing Authorization Flaw in FunnelKit Automations Plugin for WordPress & WooCommerce

CVE-2025-12469

What is CVE-2025-12469?

The FunnelKit Automations plugin for WordPress & WooCommerce is susceptible to a missing authorization vulnerability that goes unchecked in its administrative functionalities. This flaw stems from the improper validation of user permissions in the bwfan_test_email AJAX handler. Essentially, the nonce validation process does not securely restrict access, as it inadvertently exposes nonce details to all users, including unauthenticated visitors through JavaScript. Consequently, attackers with Subscriber-level authentication can exploit this vulnerability to send unauthorized emails with modified content, effectively compromising site integrity. Immediate attention to this issue is advised for site operators utilizing affected plugin versions.

References