CVE-2025-54750 in Funnel Builder Plugin
Summary
by MITRE • 08/20/2025
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FunnelKit Funnel Builder by FunnelKit allows PHP Local File Inclusion. This issue affects Funnel Builder by FunnelKit: from n/a through 3.11.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2025
The CVE-2025-54750 vulnerability represents a critical PHP Remote File Inclusion flaw in the FunnelKit Funnel Builder plugin, which falls under the broader category of improper control of filename for include/require statements. This vulnerability stems from the plugin's failure to properly validate or sanitize user-supplied input that is used in PHP include or require statements, creating a dangerous pathway for attackers to execute arbitrary code on affected systems. The vulnerability specifically impacts versions of the Funnel Builder plugin from an unspecified starting version through 3.11.1, indicating a wide range of affected installations that could potentially be exploited by threat actors.
The technical implementation of this vulnerability occurs when the plugin accepts user-provided parameters that are directly incorporated into PHP include/require functions without proper sanitization or validation. When an attacker can manipulate these parameters through input fields, URL parameters, or other injection vectors, they can trick the PHP interpreter into including and executing malicious files from remote servers or local system directories. This flaw aligns with CWE-98, which specifically addresses Improper Control of Code Execution, and represents a classic example of local file inclusion vulnerabilities that have been prevalent in web applications for many years. The vulnerability enables attackers to bypass normal access controls and potentially gain unauthorized access to sensitive system resources or execute malicious code within the context of the web application.
The operational impact of this vulnerability is severe and multifaceted, as it provides attackers with a potential pathway to achieve remote code execution on affected WordPress installations. Successful exploitation could allow threat actors to upload and execute malware, steal sensitive data, modify website content, or establish persistent backdoors within the compromised environment. The vulnerability affects not only individual websites but also poses risks to entire WordPress installations that rely on the FunnelKit plugin, potentially leading to widespread compromise of marketing automation systems and customer data. Given that Funnel Builder is designed for creating marketing funnels, the compromise of such systems could result in significant financial losses, data breaches, and reputational damage for affected organizations. This vulnerability also aligns with ATT&CK technique T1190, which covers Exploit Public-Facing Application, and T1059, which addresses Command and Scripting Interpreter, as attackers would likely leverage this vulnerability to execute malicious code.
Mitigation strategies for CVE-2025-54750 should prioritize immediate patching of affected FunnelKit plugin versions, as this represents the most effective defense against exploitation. Organizations should also implement input validation and sanitization measures to prevent user-supplied data from being directly used in include/require statements, following secure coding practices that align with OWASP Top 10 recommendations. Network-level protections such as web application firewalls and intrusion detection systems can provide additional layers of defense by monitoring for suspicious patterns associated with file inclusion attacks. Security teams should also conduct comprehensive vulnerability assessments to identify any other potentially affected plugins or components within their WordPress environments, and establish monitoring procedures to detect unauthorized modifications or suspicious activities that may indicate exploitation attempts. Regular security audits and adherence to secure development practices are essential to prevent similar vulnerabilities from emerging in future software releases.