Sensitive Information Exposure in FunnelKit Plugins for WooCommerce by FunnelKit
CVE-2025-7654
8.8HIGH
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 August 2025
What is CVE-2025-7654?
FunnelKit's Funnel Builder for WooCommerce Checkout and FunnelKit Automations plugins have a vulnerability that allows authenticated users with Contributor-level access and higher to exploit the 'wf_get_cookie' shortcode. This vulnerability enables these users to extract sensitive information, such as authentication cookies of other site users. The exposure of such data may facilitate unauthorized privilege escalation, potentially compromising the security of the site and its users.
Affected Version(s)
FunnelKit – Funnel Builder for WooCommerce Checkout * <= 3.11.0.2
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce * <= 3.6.3