FunnelKit Automations: Time-based SQL Injection (CVE-2026-119163)

The FunnelKit Automations plugin for WordPress (all versions up to and including 3.8.5.2) contains a time-based SQL injection vulnerability (CVE-2026-119163) in the 'bwfan_cart_id' parameter. Insufficient input validation and lack of prepared statements allow unauthenticated attackers to inject SQL commands.

Attack Chain

1. Attacker identifies a public-facing WooCommerce checkout endpoint.
2. Attacker obtains a valid WooCommerce cart nonce.
3. Attacker submits a crafted 'bwfan_cart_id' parameter during a guest checkout transaction.
4. The malicious input is persisted in the site database metadata.
5. The WordPress site transitions an order status (e.g., from pending, failed, or cancelled).
6. The Action Scheduler initiates a background job that reloads the malicious metadata.
7. The SQL injection is executed within the context of the database query, causing time-based delays used for data exfiltration.

Impact

Successful exploitation allows unauthenticated attackers to extract sensitive information from the underlying database.

Recommendation

• Update the FunnelKit Automations plugin to the latest available version beyond 3.8.5.2 immediately.
• Audit WordPress site logs for anomalous HTTP POST requests to WooCommerce checkout endpoints containing suspicious characters or SQL keywords in the 'bwfan_cart_id' parameter.
• Implement Web Application Firewall (WAF) rules to block or sanitize input for the 'bwfan_cart_id' parameter in WooCommerce checkout traffic.