CVE-2024-47328 Overview
CVE-2024-47328 is a SQL Injection vulnerability in the FunnelKit Automations WordPress plugin (wp-marketing-automations), developed by Aman. The flaw affects all plugin versions up to and including 3.1.2. It stems from improper neutralization of special elements used in SQL commands [CWE-89]. An authenticated attacker with high privileges can inject arbitrary SQL statements into backend database queries. Successful exploitation compromises the confidentiality, integrity, and availability of the underlying WordPress database.
Critical Impact
Authenticated attackers can extract sensitive data, modify records, or disrupt database operations on WordPress sites running FunnelKit Automations <= 3.1.2.
Affected Products
- FunnelKit Automations (wp-marketing-automations) versions up to and including 3.1.2
- WordPress installations with the FunnelKit Automations plugin enabled
- WooCommerce stores using FunnelKit Automations for cart abandonment and email marketing
Discovery Timeline
- 2024-10-21 - CVE-2024-47328 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-47328
Vulnerability Analysis
The vulnerability is classified as an SQL Injection flaw under [CWE-89]. FunnelKit Automations fails to properly sanitize user-supplied input before incorporating it into SQL queries. An attacker with high privileges on the WordPress site can craft input that alters the intended SQL statement structure. The injected payload executes against the WordPress database with the privileges of the database user configured for the site.
The attack is delivered over the network against the WordPress admin interface. Because the plugin integrates with WooCommerce cart abandonment and email marketing workflows, exploited queries may touch customer data, order records, and subscriber lists. Impact spans confidentiality, integrity, and availability of the database.
Root Cause
The root cause is improper neutralization of special elements in SQL commands. The plugin concatenates or interpolates untrusted input into SQL strings without using parameterized queries or the WordPress $wpdb->prepare() function. Special characters such as single quotes, semicolons, and SQL keywords pass through to the query engine unescaped.
Attack Vector
Exploitation requires an authenticated session with high privileges on the target WordPress site. The attacker submits crafted parameters to a vulnerable plugin endpoint. The malicious payload modifies the resulting SQL query to read, modify, or delete arbitrary database records. No user interaction beyond the attacker's own authenticated request is required.
No verified proof-of-concept code is publicly available. For technical details, review the Patchstack SQL Injection Vulnerability Report.
Detection Methods for CVE-2024-47328
Indicators of Compromise
- Unexpected SQL syntax fragments such as UNION SELECT, OR 1=1, or SLEEP( in WordPress access logs targeting FunnelKit endpoints
- Anomalous administrative requests to wp-admin paths associated with wp-marketing-automations
- Database error entries in PHP error logs referencing FunnelKit plugin queries
- Unexpected reads of wp_users, wp_usermeta, or WooCommerce order tables originating from plugin database sessions
Detection Strategies
- Enable a Web Application Firewall (WAF) with signatures for SQL injection payloads targeting WordPress admin routes
- Monitor WordPress audit logs for high-privilege accounts issuing atypical plugin actions
- Inspect MySQL query logs for suspicious patterns originating from FunnelKit plugin code paths
Monitoring Recommendations
- Alert on failed SQL syntax errors from the WordPress database user
- Track privileged administrator account activity, including logins from new IP addresses or geographies
- Correlate plugin activity with outbound data transfer volumes to identify possible data exfiltration
How to Mitigate CVE-2024-47328
Immediate Actions Required
- Upgrade FunnelKit Automations to a version later than 3.1.2 once released by the vendor
- Audit all WordPress administrator accounts and remove unused high-privilege users
- Enforce strong, unique passwords and multi-factor authentication for all administrator accounts
- Review WordPress and WooCommerce database tables for unauthorized modifications
Patch Information
The vulnerability affects FunnelKit Automations through version 3.1.2. Site administrators should consult the Patchstack advisory for the latest patched version and update the plugin through the WordPress plugin manager.
Workarounds
- Deploy a WordPress-aware WAF such as Patchstack, Wordfence, or a Cloudflare managed ruleset to block SQL injection payloads
- Restrict access to wp-admin by IP allowlist where operationally feasible
- Temporarily disable the FunnelKit Automations plugin if patching cannot be performed promptly
- Apply least-privilege principles to the WordPress database user, limiting DROP, ALTER, and FILE privileges
# Update FunnelKit Automations via WP-CLI once a patched version is available
wp plugin update wp-marketing-automations --version=<patched_version>
# Verify the installed plugin version
wp plugin get wp-marketing-automations --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
