Time-Based Blind SQL Injection in FunnelKit Plugin for WooCommerce

CVE-2025-14169

What is CVE-2025-14169?

The FunnelKit plugin for WooCommerce Checkout is susceptible to time-based blind SQL injection vulnerabilities through the 'opid' parameter. This flaw is due to improper escaping of user-supplied input and inadequate preparation of SQL queries. Attackers who are not authenticated can exploit this vulnerability to inject additional SQL commands, potentially leading to unauthorized access to sensitive data stored in the database. It's crucial for users of the plugin to ensure they are using the latest version to mitigate this risk.

References