CVE-2025-12469 Overview
CVE-2025-12469 affects the FunnelKit Automations plugin for WordPress and WooCommerce in all versions up to and including 3.6.4.1. The plugin exposes a bwfan_test_email AJAX handler that fails to enforce proper authorization checks. The nonce required for the action is publicly rendered in frontend JavaScript localization, and the check_nonce() function accepts low-privilege authenticated users who present that nonce. Authenticated attackers holding Subscriber-level access can send arbitrary emails from the site with attacker-controlled subject lines and body content. The flaw is categorized under [CWE-862] Missing Authorization.
Critical Impact
Subscriber-level accounts can abuse the site's outbound mail infrastructure to send arbitrary messages, enabling phishing campaigns and brand impersonation that originate from the trusted domain.
Affected Products
- FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce
- All plugin versions up to and including 3.6.4.1
- WordPress and WooCommerce sites running the vulnerable plugin
Discovery Timeline
- 2025-11-05 - CVE-2025-12469 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12469
Vulnerability Analysis
The vulnerability resides in the plugin's AJAX controller, specifically the handler registered for the bwfan_test_email action. The handler is designed for administrators who need to preview transactional email templates. However, the controller relies solely on nonce verification through check_nonce() and omits a capability check such as current_user_can('manage_options').
The nonce that gates this action is emitted through wp_localize_script in the public-facing script bundle. Any visitor loading the site's frontend receives the nonce inside a JavaScript variable. A logged-in Subscriber can read this value, craft a POST request to admin-ajax.php, and invoke the test-email routine with arbitrary recipient, subject, and body parameters. The result is unauthenticated-adjacent abuse of a privileged mail-sending path.
Root Cause
The root cause is a design assumption that nonce possession equals authorization. WordPress nonces are anti-CSRF tokens, not authorization primitives. Because the plugin injects the nonce into public output and check_nonce() accepts any authenticated session, the effective access boundary collapses to "any registered user" on sites permitting Subscriber registration.
Attack Vector
An attacker registers or already holds a Subscriber account on the target WordPress site. They visit any public page to harvest the bwfan nonce from localized script data. They then issue an authenticated POST request to /wp-admin/admin-ajax.php with action=bwfan_test_email, the harvested nonce, and controlled subject and body fields. The site's mail transport delivers the message from a trusted sender domain.
// No verified proof-of-concept code is published for CVE-2025-12469.
// See the vendor patch in WordPress Plugin Changeset 3388822 for the
// exact modification that adds the missing capability check to the
// bwfan_test_email handler.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-12469
Indicators of Compromise
- Unexpected POST requests to /wp-admin/admin-ajax.php containing action=bwfan_test_email originating from Subscriber-level session cookies.
- Outbound email logs showing messages generated by the FunnelKit test-email path to recipients not associated with the site's normal marketing lists.
- New user registrations followed shortly by AJAX activity targeting bwfan_ actions.
Detection Strategies
- Enable WordPress request logging or a web application firewall rule that captures admin-ajax.php bodies and alerts on the bwfan_test_email action from users below Editor role.
- Correlate WordPress user role data with mail transfer agent logs to identify Subscribers triggering outbound SMTP traffic.
- Review plugin audit logs for invocations of the bwfan_test_email handler outside administrator sessions.
Monitoring Recommendations
- Monitor mail queue volume and bounce rates for anomalies that suggest abuse of transactional mail paths.
- Track spikes in Subscriber account registrations followed by authenticated AJAX activity.
- Watch for outbound messages whose subject or body content deviates from configured FunnelKit templates.
How to Mitigate CVE-2025-12469
Immediate Actions Required
- Update the FunnelKit Automations plugin to a version above 3.6.4.1 that includes the fix from WordPress Plugin Changeset 3388822.
- Audit existing WordPress accounts and remove unused Subscriber-level users.
- Review recent outbound email logs for messages sent through the bwfan_test_email handler.
Patch Information
The vendor released the fix in WordPress Plugin Changeset 3388822, which adds a capability check to the bwfan_test_email AJAX handler. Additional technical context is available in the Wordfence Vulnerability ID 72198 advisory.
Workarounds
- Disable open user registration in Settings → General until the plugin is updated.
- Temporarily deactivate the FunnelKit Automations plugin on sites that cannot patch immediately.
- Deploy a web application firewall rule that blocks admin-ajax.php requests containing action=bwfan_test_email from sessions whose role is below Editor.
# Example WP-CLI commands to inventory FunnelKit installations and
# identify Subscriber accounts that should be reviewed.
wp plugin get wp-marketing-automations --field=version
wp user list --role=subscriber --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
