CVE-2025-30795 Overview
CVE-2025-30795 is an open redirect vulnerability in the FunnelKit Automations WordPress plugin (wp-marketing-automations) developed by Aman. The flaw affects all plugin versions up to and including 3.5.1. Attackers can craft URLs that appear to originate from a trusted WordPress site but redirect victims to attacker-controlled destinations. This behavior enables phishing campaigns and credential theft against site visitors. The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site).
Critical Impact
Attackers can abuse trusted WordPress domains running FunnelKit Automations to redirect users to phishing pages, undermining brand trust and enabling credential harvesting.
Affected Products
- FunnelKit Automations (wp-marketing-automations) plugin versions through 3.5.1
- WordPress sites running the Automation by Autonami plugin
- Marketing automation workflows relying on FunnelKit redirection endpoints
Discovery Timeline
- 2025-03-27 - CVE-2025-30795 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-30795
Vulnerability Analysis
The FunnelKit Automations plugin exposes a redirection endpoint that accepts a URL parameter without validating whether the destination points to an approved host. An unauthenticated attacker constructs a URL on the victim WordPress site that embeds an external destination. When a user clicks the link, the plugin issues an HTTP redirect to the attacker-supplied location. The exploit requires user interaction — typically clicking a link from email, chat, or a compromised page — and does not modify data on the WordPress site itself. Because the initial URL resides on the trusted domain, users and email security tools may treat it as legitimate. Attackers leverage this trust to stage phishing pages that mimic the target brand.
Root Cause
The plugin fails to enforce an allowlist of trusted redirect targets before performing the redirection. Input validation on the destination URL parameter is absent or insufficient, allowing arbitrary absolute URLs. This is a classic [CWE-601] pattern where redirection logic trusts client-supplied data.
Attack Vector
Exploitation occurs over the network with low complexity and no authentication. The attacker crafts a URL pointing at the vulnerable FunnelKit endpoint on a target WordPress site, appending a malicious destination parameter. The attacker distributes the link through phishing email, social media, or malvertising. When the victim clicks the link, the WordPress site issues a 3xx response redirecting the browser to the attacker's phishing page. No exploit code is publicly available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are documented in the Patchstack WordPress Vulnerability Report.
Detection Methods for CVE-2025-30795
Indicators of Compromise
- HTTP requests to FunnelKit Automations endpoints containing absolute URLs in redirect parameters pointing to unfamiliar external hosts
- Web server access logs showing 3xx responses with Location headers referencing domains outside the site's approved list
- Referrer chains where users arrive from the WordPress site and land on lookalike or credential-collection domains
Detection Strategies
- Inspect WordPress access logs for requests to wp-marketing-automations handlers with query parameters that decode to external URLs
- Alert on outbound redirects whose target host does not match the site's registered domains or configured trusted partners
- Correlate spikes in redirect traffic with newly registered domains or domains flagged by threat intelligence feeds
Monitoring Recommendations
- Enable verbose logging on the WordPress reverse proxy or web application firewall to capture full request URIs and Location response headers
- Monitor user reports of phishing links that originate from the organization's WordPress domain
- Track FunnelKit plugin version inventory across managed WordPress instances and flag deployments at or below 3.5.1
How to Mitigate CVE-2025-30795
Immediate Actions Required
- Upgrade FunnelKit Automations to a version later than 3.5.1 once the vendor publishes a patched release
- Audit all sites for the presence of the wp-marketing-automations plugin and confirm installed versions
- Review recent WordPress access logs for suspicious redirect activity and notify users who may have clicked malicious links
Patch Information
Refer to the Patchstack advisory for the current patch status and fixed version details. Apply the vendor-supplied update through the WordPress plugin manager as soon as it becomes available.
Workarounds
- Deploy a web application firewall rule that blocks requests to FunnelKit redirect endpoints containing absolute external URLs
- Restrict access to marketing automation endpoints to authenticated administrative users where feasible
- Add server-side rewrite rules that strip or validate redirect target parameters before they reach the plugin
- Educate users to inspect the final destination of links, especially those arriving through marketing campaigns
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
