{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afunnelkitautomationswordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:funnelkit:automations:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-119163"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FunnelKit Automations (\u003c= 3.8.5.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FunnelKit"],"content_html":"\u003cp\u003eThe FunnelKit Automations plugin for WordPress (all versions up to and including 3.8.5.2) contains a time-based SQL injection vulnerability (CVE-2026-119163) in the 'bwfan_cart_id' parameter. Insufficient input validation and lack of prepared statements allow unauthenticated attackers to inject SQL commands.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a public-facing WooCommerce checkout endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker obtains a valid WooCommerce cart nonce.\u003c/li\u003e\n\u003cli\u003eAttacker submits a crafted 'bwfan_cart_id' parameter during a guest checkout transaction.\u003c/li\u003e\n\u003cli\u003eThe malicious input is persisted in the site database metadata.\u003c/li\u003e\n\u003cli\u003eThe WordPress site transitions an order status (e.g., from pending, failed, or cancelled).\u003c/li\u003e\n\u003cli\u003eThe Action Scheduler initiates a background job that reloads the malicious metadata.\u003c/li\u003e\n\u003cli\u003eThe SQL injection is executed within the context of the database query, causing time-based delays used for data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to extract sensitive information from the underlying database.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the FunnelKit Automations plugin to the latest available version beyond 3.8.5.2 immediately.\u003c/li\u003e\n\u003cli\u003eAudit WordPress site logs for anomalous HTTP POST requests to WooCommerce checkout endpoints containing suspicious characters or SQL keywords in the 'bwfan_cart_id' parameter.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to block or sanitize input for the 'bwfan_cart_id' parameter in WooCommerce checkout traffic.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T07:53:01Z","date_published":"2026-10-31T07:53:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-funnelkit-sqli/","summary":"The FunnelKit Automations plugin for WordPress is vulnerable to time-based SQL injection via the bwfan_cart_id parameter, allowing unauthenticated attackers to extract database information during delayed Action Scheduler job execution.","title":"FunnelKit Automations: Time-based SQL Injection (CVE-2026-119163)","url":"https://feed.craftedsignal.io/briefs/2026-10-funnelkit-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:funnelkit:automations:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}