CPE
The FunnelKit Automations plugin for WordPress is vulnerable to time-based SQL injection via the bwfan_cart_id parameter, allowing unauthenticated attackers to extract database information during delayed Action Scheduler job execution.