CVE-2025-49868: FunnelKit Automations Open Redirect Flaw

CVE-2025-49868 Overview

CVE-2025-49868 is an open redirect vulnerability in the FunnelKit Automations WordPress plugin (wp-marketing-automations) by Aman. The flaw affects all versions up to and including 3.6.0. Attackers can craft URLs that appear to originate from the trusted WordPress site but redirect victims to attacker-controlled domains. This behavior enables phishing campaigns that abuse the site's reputation to harvest credentials or deliver malware. The vulnerability is classified under CWE-601: URL Redirection to Untrusted Site and requires user interaction to trigger successful exploitation.

Critical Impact
Attackers can weaponize trusted WordPress domains to redirect visitors to phishing pages, bypassing user trust indicators and URL inspection habits.

Affected Products

FunnelKit Automations (wp-marketing-automations) plugin versions through 3.6.0
WordPress sites running the Autonami Automation plugin
Any site using vulnerable FunnelKit Automations installations

Discovery Timeline

2025-06-17 - CVE-2025-49868 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49868

Vulnerability Analysis

The vulnerability resides in the FunnelKit Automations plugin's handling of redirect parameters. The plugin accepts a destination URL from a request parameter and issues an HTTP redirect without validating whether the target belongs to an allowlisted domain. An attacker constructs a link pointing to the vulnerable WordPress site but embeds an external URL in the redirect parameter. When a victim clicks the link, the browser follows a same-origin request to the trusted site, which then forwards the victim to the attacker's domain.

Exploitation requires user interaction, typically through clicking a crafted link delivered via email, social media, or malicious advertisements. The attack does not require authentication on the target WordPress instance.

Root Cause

The root cause is missing or insufficient validation of user-supplied redirect destinations. The plugin trusts the redirect target parameter without enforcing a domain allowlist, checking for absolute versus relative URLs, or rejecting off-site destinations. This design flaw maps directly to CWE-601.

Attack Vector

An attacker crafts a link such as https://victim-site.example/?redirect=https://attacker.example/phish. The URL appears legitimate because the visible domain matches the trusted WordPress site. Email security gateways and URL reputation services often permit these links because the initial destination is a known-good domain. Once clicked, the FunnelKit Automations endpoint issues a 302 response to the attacker-controlled URL, delivering the victim to a phishing page that may imitate the original site's branding.

See the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-49868

Indicators of Compromise

Web server logs containing requests to FunnelKit Automations endpoints with external URLs in redirect parameters
HTTP 302 responses from wp-marketing-automations endpoints pointing to third-party domains
Referrer headers on downstream phishing domains showing the trusted WordPress site as the origin
User reports of unexpected redirects from links appearing to originate from the WordPress site

Detection Strategies

Inspect access logs for query parameters containing full URLs (http:// or https:// values) targeting plugin endpoints
Correlate outbound 3xx responses with destination hosts outside the site's own domain
Deploy web application firewall (WAF) rules that flag redirect parameters containing external hostnames
Monitor threat intelligence feeds for phishing campaigns referencing the affected domain

Monitoring Recommendations

Enable verbose logging on WordPress and reverse proxy layers to capture full request URIs
Alert on spikes in traffic to plugin URLs with redirect-style parameters
Track user-agent and geographic anomalies on endpoints known to accept redirect parameters

How to Mitigate CVE-2025-49868

Immediate Actions Required

Update FunnelKit Automations to a version above 3.6.0 once a patched release is available from the vendor
Audit all WordPress plugin inventories to identify sites running vulnerable versions of wp-marketing-automations
Deploy WAF rules blocking requests with absolute external URLs in redirect parameters
Notify users and customers about the phishing risk and reinforce link verification practices

Patch Information

Consult the Patchstack Vulnerability Report for the latest patch status and vendor-provided fixes. Apply the vendor-supplied update as soon as it becomes available for versions after 3.6.0.

Workarounds

Restrict access to FunnelKit Automations endpoints through WAF rules until a patch is applied
Implement server-side rewrite rules that strip or validate redirect parameters before requests reach the plugin
Disable the FunnelKit Automations plugin on non-essential sites until an updated version is installed

bash

# Example WAF rule concept to block external redirects
# ModSecurity rule: deny requests where redirect parameter contains an absolute URL
SecRule ARGS_NAMES "@rx (redirect|url|return|next|dest)" \
    "chain,phase:2,deny,status:403,id:1004901,\
    msg:'Potential open redirect exploitation attempt'"
    SecRule ARGS "@rx ^https?://" "t:none,t:lowercase"