CVE-2026-119163 in FunnelKit Automations Plugin
Summary
by MITRE • 10/31/2026
The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the 'bwfan_cart_id' parameter in all versions up to, and including, 3.8.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step persisted attack: an unauthenticated attacker submits a crafted bwfan_cart_id value during a guest Store API checkout (requiring only a publicly obtainable WooCommerce cart nonce), and the injection fires when a scheduled Action Scheduler job later reloads the stored meta upon order status transition out of pending, failed, or cancelled.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/31/2026
The FunnelKit Automations plugin for WordPress and WooCommerce contains a critical time-based SQL Injection vulnerability affecting all versions up to 3.8.5.2. This flaw resides within the bwfan_cart_id parameter, which is processed during checkout operations via the Store API. The root cause of this vulnerability is insufficient input validation and sanitization combined with a lack of proper query preparation mechanisms. Specifically, user-supplied data is not adequately escaped before being incorporated into SQL queries executed by the application backend. This deficiency allows an unauthenticated attacker to inject malicious SQL code that alters the logic of existing database operations. The vulnerability aligns with CWE-89, which defines Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection.
Exploitation of this flaw requires a two-step process that leverages both immediate interaction and delayed execution through scheduled tasks. Initially, the attacker submits a crafted bwfan_cart_id value during a guest checkout session on a WooCommerce store. This step only requires access to a publicly obtainable WooCommerce cart nonce, which is typically available without authentication. The malicious payload is then stored in the database as part of the order metadata or cart information. The injection does not trigger immediately but rather activates later when an Action Scheduler job processes the data. Specifically, the vulnerability fires when the system reloads this stored meta during a transition of the order status away from pending, failed, or cancelled states. This delayed execution mechanism makes detection more difficult as the malicious activity appears to originate from legitimate background administrative tasks rather than direct user input at the time of exploitation.
The operational impact of this SQL Injection is severe due to its unauthenticated nature and persistence within the database. Attackers can exploit the time-based blind technique to extract sensitive information from the WordPress database, including administrator credentials, customer personal data, payment details, and other proprietary business logic stored in custom tables. Because the injection occurs during background job execution, it may bypass certain real-time security monitoring tools that focus on immediate HTTP request anomalies. The ability to exfiltrate data silently over time increases the risk of long-term compromise without immediate detection by site administrators or standard web application firewalls configured for traditional SQLi patterns.
Mitigation strategies must address both the immediate vulnerability and the broader security posture regarding database interactions. The primary remediation is to upgrade FunnelKit Automations to a version newer than 3.8.5.2, where developers have implemented proper input sanitization and parameterized queries or prepared statements for all SQL operations involving user-supplied data. Until an update is applied, administrators should consider restricting access to the WooCommerce Store API endpoints if possible, although this may impact legitimate guest checkout functionality. Additionally, implementing a Web Application Firewall with rules specifically tuned for time-based blind SQL injection patterns can help detect and block exploitation attempts during both the initial submission phase and subsequent background job executions. Regular auditing of Action Scheduler logs should also be conducted to identify any anomalous database queries that deviate from expected execution times or result sets, which may indicate active exploitation of this vulnerability.