CVE-2025-2186: FunnelKit WordPress Plugin SQLi Vulnerability

CVE-2025-2186 Overview

A SQL Injection vulnerability exists in the Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress. The vulnerability is present in all versions up to and including 3.5.1 and stems from insufficient escaping on the user-supplied automationId parameter combined with inadequate preparation of the existing SQL query. This security flaw allows unauthenticated attackers to append additional SQL queries to existing database queries, potentially extracting sensitive information from the WordPress database.

Critical Impact

Unauthenticated SQL Injection allows attackers to extract sensitive data from the database without any authentication, potentially exposing customer information, credentials, and other confidential data stored by WooCommerce stores.

Affected Products

• FunnelKit WP Marketing Automations plugin versions up to and including 3.5.1
• WordPress installations running vulnerable versions of the FunnelKit plugin
• WooCommerce stores using the Cart Abandonment and Marketing Automation features

Discovery Timeline

• 2025-03-22 - CVE-2025-2186 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-2186

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) affects the FunnelKit WordPress plugin's API functionality, specifically within the dynamic coupon generation endpoint. The vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. An attacker can leverage this flaw to extract confidential data from the database, including customer PII, order details, and potentially WordPress user credentials.

The vulnerability exists due to improper handling of the automationId parameter in the class-bwfan-api-get-automation-dynamic-coupon.php file. The parameter value is incorporated directly into SQL queries without proper sanitization or parameterized query preparation, creating a classic SQL injection attack surface.

Root Cause

The root cause of this vulnerability is the failure to properly sanitize and escape user-supplied input before incorporating it into SQL queries. The automationId parameter lacks sufficient input validation and the associated SQL query does not use prepared statements with proper parameter binding. This allows malicious SQL syntax injected through the parameter to be interpreted and executed by the database engine.

Attack Vector

The attack vector is network-based, targeting the WordPress REST API endpoint responsible for handling dynamic coupon automation requests. An unauthenticated attacker can craft malicious HTTP requests containing SQL injection payloads in the automationId parameter. Since no authentication is required, this vulnerability can be exploited remotely by any attacker who can reach the WordPress installation.

The exploitation mechanism involves injecting SQL syntax through the automationId parameter to manipulate the underlying database query. By using techniques such as UNION-based injection or blind SQL injection, attackers can enumerate database tables, extract sensitive records, or gather information about the database structure. For technical implementation details, refer to the WordPress Plugin Code Review.

Detection Methods for CVE-2025-2186

Indicators of Compromise

• Unusual database queries in MySQL/MariaDB logs containing SQL injection patterns such as UNION SELECT, OR 1=1, or encoded payloads targeting the automation coupon endpoint
• HTTP access logs showing repeated requests to the FunnelKit API endpoints with abnormal automationId parameter values
• Database audit logs indicating extraction of sensitive tables or columns not typically accessed by the plugin
• Unexpected spikes in database query errors or slow query logs related to the FunnelKit plugin tables

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in the automationId parameter
• Monitor WordPress REST API access logs for suspicious requests to /wp-json/ endpoints related to FunnelKit automation features
• Deploy database activity monitoring to alert on unusual query patterns or data extraction attempts
• Utilize SentinelOne's Singularity platform to detect anomalous process behavior and network connections associated with WordPress exploitation

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests and review logs for injection attempts
• Configure intrusion detection systems (IDS) to alert on common SQL injection signatures in HTTP traffic
• Implement database query monitoring to detect unauthorized data access patterns
• Set up file integrity monitoring for WordPress plugin files to detect unauthorized modifications

How to Mitigate CVE-2025-2186

Immediate Actions Required

• Update the FunnelKit WP Marketing Automations plugin to version 3.5.2 or later immediately
• Review database access logs for signs of exploitation and potential data exfiltration
• Consider temporarily disabling the FunnelKit plugin if an immediate update is not possible
• Conduct a security audit of the WordPress database to identify any unauthorized access or data extraction

Patch Information

The vulnerability has been addressed in the plugin update referenced in the WordPress Changeset Update. Site administrators should update through the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository. The patch implements proper input sanitization and prepared statements for the affected SQL query. For detailed vulnerability information, consult the Wordfence Vulnerability Report.

Workarounds

• Implement a Web Application Firewall (WAF) with rules to block SQL injection attempts targeting the automationId parameter
• Restrict access to the WordPress REST API using .htaccess rules or security plugins to limit exposure
• Apply principle of least privilege to WordPress database users to minimize potential damage from exploitation
• If feasible, temporarily disable the FunnelKit plugin until the patch can be applied

# Example .htaccess rule to restrict REST API access (Apache)
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/funnelkit/ [NC]
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. [NC]
RewriteRule ^(.*)$ - [F,L]
</IfModule>