SQL Injection in FunnelKit Plugin for WordPress Affecting Cart Recovery and Marketing Automation
CVE-2025-2186
7.5HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 22 March 2025
What is CVE-2025-2186?
The FunnelKit plugin used for recovering abandoned carts and managing marketing activities on WordPress is susceptible to SQL Injection through the 'automationId' parameter. Versions up to and including 3.5.1 lack proper input validation, allowing unauthenticated attackers to inject malicious SQL queries. This vulnerability enables attackers to manipulate the database queries and potentially gain access to sensitive data, putting user information at risk.
Affected Version(s)
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce * <= 3.5.1