CVE-2025-12468: FunnelKit Information Disclosure Flaw

CVE-2025-12468 Overview

CVE-2025-12468 affects the FunnelKit Automations – Email Marketing Automation and CRM plugin for WordPress and WooCommerce. The vulnerability exists in all versions up to and including 3.6.4.1. The plugin exposes the /wc-coupons/ REST API endpoint as a public API, bypassing authentication and capability checks. Unauthenticated attackers can extract WooCommerce coupon codes, coupon IDs, and expiration status from affected sites. The flaw is categorized as Sensitive Information Exposure [CWE-200].

Critical Impact
Unauthenticated remote attackers can enumerate all WooCommerce coupon codes and metadata over the network without user interaction, enabling fraudulent order discounts and revenue loss.

Affected Products

FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
All plugin versions up to and including 3.6.4.1
WordPress sites running WooCommerce with the vulnerable plugin installed

Discovery Timeline

2025-11-05 - CVE-2025-12468 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12468

Vulnerability Analysis

The vulnerability resides in the plugin's REST API loader logic. The /wc-coupons/ endpoint is flagged with the attribute public_api = true in the API class definition. When the API loader processes endpoints marked as public, it registers them with WordPress using permission_callback => '__return_true'. This callback unconditionally returns true, skipping every authentication and capability verification WordPress would normally enforce.

Because the endpoint returns WooCommerce coupon data, any anonymous HTTP client can request the endpoint and receive the full list of coupons. The response includes coupon codes, internal coupon IDs, and expiration status. This information supports downstream fraud, such as redeeming active discount codes on the storefront.

The vulnerability does not affect data integrity or availability. It only exposes confidential store data over the network.

Root Cause

The root cause is an insecure default configuration in the REST API registration logic. Marking an endpoint as public_api should not imply the absence of authorization checks for endpoints that return business-sensitive data. The design conflates "public routing" with "public data," and the __return_true permission callback removes all access control.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker sends an unauthenticated HTTP GET request to the /wp-json/ route corresponding to the plugin's /wc-coupons/ endpoint. The server returns the coupon dataset in JSON format. No credentials, tokens, or user interaction are required.

Refer to the WordPress Coupon API Code and the WordPress API Loader Code for the affected source.

Detection Methods for CVE-2025-12468

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-json/ routes containing wc-coupons from external IP addresses
Repeated 200 OK responses to the coupon endpoint from clients that never authenticate
Sudden spikes in redemptions of coupons that were not publicly advertised
User agents associated with scanners or scraping frameworks touching WordPress REST routes

Detection Strategies

Review web server access logs for requests matching the pattern GET /wp-json/*wc-coupons* originating from unauthenticated sessions
Correlate coupon usage data in WooCommerce order records against the source of coupon distribution
Deploy WAF rules that flag anonymous access to plugin-registered REST endpoints returning JSON coupon data

Monitoring Recommendations

Enable verbose logging on the WordPress REST API layer and forward logs to a centralized SIEM for anomaly analysis
Alert on any external IP requesting more than a small threshold of /wp-json/ endpoints per minute
Track FunnelKit Automations plugin version across all managed WordPress instances to identify vulnerable installations

How to Mitigate CVE-2025-12468

Immediate Actions Required

Update FunnelKit Automations to a version later than 3.6.4.1 on every affected WordPress site
Rotate all active WooCommerce coupon codes if unauthenticated access to /wc-coupons/ is suspected
Audit recent WooCommerce orders for redemptions of internal or non-public coupon codes
Restrict access to the /wp-json/ path from untrusted networks where possible

Patch Information

The vendor has addressed the issue in versions released after 3.6.4.1. Administrators should apply the latest plugin update from the WordPress plugin repository. Consult the Wordfence Vulnerability Analysis for advisory details.

Workarounds

Deactivate the FunnelKit Automations plugin until the patched version can be installed
Add a web application firewall rule to block unauthenticated requests to any URL containing wc-coupons
Restrict WordPress REST API access to authenticated users using a security plugin or a custom rest_authentication_errors filter

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location ~* /wp-json/.*wc-coupons {
    if ($http_authorization = "") {
        return 403;
    }
}