Cpe:2.3:a:funnelkit:automations:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afunnelkitautomationswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 07:53:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFunnelKit Automations: Time-based SQL Injection (CVE-2026-119163)https://feed.craftedsignal.io/briefs/2026-10-funnelkit-sqli/Sat, 31 Oct 2026 07:53:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-funnelkit-sqli/The FunnelKit Automations plugin for WordPress is vulnerable to time-based SQL injection via the bwfan_cart_id parameter, allowing unauthenticated attackers to extract database information during delayed Action Scheduler job execution.The FunnelKit Automations plugin for WordPress (all versions up to and including 3.8.5.2) contains a time-based SQL injection vulnerability (CVE-2026-119163) in the 'bwfan_cart_id' parameter. Insufficient input validation and lack of prepared statements allow unauthenticated attackers to inject SQL commands.

Attack Chain

  1. Attacker identifies a public-facing WooCommerce checkout endpoint.
  2. Attacker obtains a valid WooCommerce cart nonce.
  3. Attacker submits a crafted 'bwfan_cart_id' parameter during a guest checkout transaction.
  4. The malicious input is persisted in the site database metadata.
  5. The WordPress site transitions an order status (e.g., from pending, failed, or cancelled).
  6. The Action Scheduler initiates a background job that reloads the malicious metadata.
  7. The SQL injection is executed within the context of the database query, causing time-based delays used for data exfiltration.

Impact

Successful exploitation allows unauthenticated attackers to extract sensitive information from the underlying database.

Recommendation

  • Update the FunnelKit Automations plugin to the latest available version beyond 3.8.5.2 immediately.
  • Audit WordPress site logs for anomalous HTTP POST requests to WooCommerce checkout endpoints containing suspicious characters or SQL keywords in the 'bwfan_cart_id' parameter.
  • Implement Web Application Firewall (WAF) rules to block or sanitize input for the 'bwfan_cart_id' parameter in WooCommerce checkout traffic.
]]>highadvisory