Arbitrary Plugin Installation Risk in FunnelKit Marketing Automation for WordPress
CVE-2025-1562
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 18 June 2025
What is CVE-2025-1562?
The FunnelKit Marketing Automation plugin for WordPress is affected by a vulnerability that allows unauthorized arbitrary plugin installations. Due to a missing capability check in the install_or_activate_addon_plugins() function coupled with a weak nonce hash, unauthenticated attackers can exploit this issue to install arbitrary plugins. This can lead to the installation of malicious software that further compromises the security of the WordPress site. Users of the plugin should ensure they are using the latest version to mitigate this risk.
Affected Version(s)
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce * <= 3.5.3