SQL Injection Vulnerability in FunnelKit Automations Plugin for WordPress

CVE-2026-119163

What is CVE-2026-119163?

The FunnelKit Automations plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter across all versions up to 3.8.5.2. Due to inadequate escaping of user-supplied input and insufficient preparation of SQL queries, unauthenticated attackers can inject additional SQL commands, potentially allowing access to sensitive database information. This exploit occurs in a two-step process, where an attacker crafts a malicious bwfan_cart_id value during a guest Store API checkout. The SQL injection is executed when a scheduled Action Scheduler job later handles the stored meta during order status transitions, increasing the risk of unauthorized data exposure.

References